Difference between revisions of "ExFAT"
From SleuthKitWiki
Apriestman (Talk | contribs) (Creating basic page) |
Apriestman (Talk | contribs) m |
||
| Line 1: | Line 1: | ||
| − | ExFAT (Extended File Allocation Table) is a newer file system designed by Microsoft to be used on removable media. It is one of the file systems supported by [[TSK]]. See the [[exFAT Implementation Notes]] for details on how exFAT support was added to TSK. | + | ExFAT (Extended File Allocation Table) is a newer (2006) file system designed by Microsoft to be used on removable media. It is one of the file systems supported by [[TSK]]. ExFAT shares many properties with the [[FAT]] file system, but also has significant differences, the largest probably being that file data is no longer stored exclusively by FAT chains. See the [[exFAT Implementation Notes]] for details on how exFAT support was added to TSK. |
Docs used during development: | Docs used during development: | ||
* http://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274 | * http://www.sans.org/reading-room/whitepapers/forensics/reverse-engineering-microsoft-exfat-file-system-33274 | ||
Latest revision as of 14:37, 2 January 2014
ExFAT (Extended File Allocation Table) is a newer (2006) file system designed by Microsoft to be used on removable media. It is one of the file systems supported by TSK. ExFAT shares many properties with the FAT file system, but also has significant differences, the largest probably being that file data is no longer stored exclusively by FAT chains. See the exFAT Implementation Notes for details on how exFAT support was added to TSK.
Docs used during development:
