HTCIA – An Introduction to the Microsoft exFAT File System 1.01 Final
Session: Introduction to the Microsoft Extended File System (exFAT)
This session will examine the internals of the Microsoft Extended FAT file system (nicknamed FAT64) which was designed for use with removable storage devices and is the exclusive file system of the new SDXC digital media standard. This new format creates many challenges for the forensics examiner. With minimal documentation on the internals of exFAT, and with exFAT experiencing a very high adoption rate, the forensics examiner needs guidance on how to navigate the filesystem. This session will explain the various internal tables and directory formats and show the differences from previous legacy forms of FAT, such as FAT12/16 and FAT32.
Presentation ngiven at HTCIA International Conference 2014 at Hyatt Lost Pines Resort & Spa in Austin Texas on Tuesday August 26, 2014 at 8am, in room Lost Pines 3
HTCIA has its annual conference, and this year they will be having it in Austin Teas during the last week of August, 2014.
For more information: http://www.htciaconference.org/
I was contacted and informed that I will be presenting my exFAT presentation on Tuesday morning of the conference. It is an early morning session, but I’ll survive (I’m not a morning person). I have spent a lot of time over the past few weeks working on updating the presentation, and found out some stuff that has happened over the past few years. I also managed to get a couple of SDXC cards and checking those out as well.
I have been invited by the meet-up group NYC4SEC to do a presentation on the exFAT file system on June 11, 2014 and by HTCIA at their 2014 International conference on Tuesday August 26, 2014.
Been updating the power point deck to pick up any good stuff to add. After I give the presentations I’ll post the new decks to this blog. I also expect to be adding sone new stuff as well. I have a SDXC card on order and will be doing some testing and acquisitions which I have been wanting to check out for a while now!