ExFAT Implementation Notes

From SleuthKitWiki
Revision as of 09:23, 30 December 2013 by Apriestman (Talk | contribs)

Jump to: navigation, search

Note: Need to add links to this, and probably some exFAT stuff in general to the wiki when this page is done.

Introduction

Disk Unit Addressing

Like FAT, exFAT saves file content in clusters, which are groupings of consecutive sectors (512-bytes each). It has the same problems as FAT in using these clusters as the addressable units, so like FAT the solution is to use sectors as the addressable unit instead. See FAT_Implementation_Notes#Disk_Unit_Addressing for more information.

Metadata Addressing

Again, exFAT shares the same problems discussed in FAT_Implementation_Notes#Metadata_Addressing, and the same solution is used. Note that normal exFAT files have at least three directory entry structures (more the longer the filename is), so the metadata addresses will increase by three or more for files in the same directory.