Session: Introduction to the Microsoft Extended File System (exFAT)
This session will examine the internals of the Microsoft Extended FAT file system (nicknamed FAT64) which was designed for use with removable storage devices and is the exclusive file system of the new SDXC digital media standard. This new format creates many challenges for the forensics examiner. With minimal documentation on the internals of exFAT, and with exFAT experiencing a very high adoption rate, the forensics examiner needs guidance on how to navigate the filesystem. This session will explain the various internal tables and directory formats and show the differences from previous legacy forms of FAT, such as FAT12/16 and FAT32.
Presentation ngiven at HTCIA International Conference 2014 at Hyatt Lost Pines Resort & Spa in Austin Texas on Tuesday August 26, 2014 at 8am, in room Lost Pines 3