Session 06 - FAT Filesystem

Requirements:

• FAT16USB.img (MD5: D4EAEE279402DE18FD02C32975906053)
• HANDOUT-FAT16-Reference.pdf
• A hex editor, for example HxD (https://www.mh-nexus.de/)
• Pen and paper (Nope, this is not a joke, to complete the lab, you'll have a much easier time using pen and paper to recreate the table information and then fill in your answers)
• Microsoft's "How FAT Works" documentation: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc776720(v=ws.10)

Task 1: Start your hex editor and load the forensic image

1. If you're using HxD, then open the Tools menu and choose Open disk image...
2. Check the MD5 hash of the image: (if you're on Linux, you know what to do), otherwise in HxD, select Analysis then Checksums, choose MD5 and click OK.
3. Keep a record of the MD5 (remember, you should be doing this as part of your contemporaneous notes anyway).
4. Does the hash match the one at the top of this document? Make a note if it does or doesn't.

Task 2: Analysis and interpretation of the FAT16 Reserved Area/Boot Sector

Hint on using offsets: To find a hexadecimal offset, add the row offset to the column offset.

Example: Offset 0x1A would be the intersection of row 00000010, column A (as seen below, you'll find the value 0xFF).

1. In which sector is the Boot sector located?

2. Use the handout (mentioned at the top of this document) and examine the sector you identified in 1 to complete the following table:

Hint: Make sure you reverse the byte order for values stored in more than 1 byte (recall: little-endian).

Table 1:

Task 3: Find the Root Directory and Data Regions

1. Use your answers from Task 2 to calculate the offset from the start of the volume to the Root Directory using the following formula:

RDO (Root Directory Offset)
NRS (No. of Reserved Sectors before FAT1)
NFT (No. of FAT Tables)
SF  (Sectors per FAT)

RDO = NRS + (NFT * SF)

2. Enter the Root Directory Offset into the Sector box in HxD (if you're using another hex editor it should have similar functionality) to jump to that sector, as seen in the figure below.

3. Use the handout to record the size of EACH directory entry in bytes. What size (in bytes) did you record?

4. The size of the Root Directory is found using the following formula:

RDS (Root Directory Size)
MNE (Max no. of Entries = 512)
SEE (Size of Each Entry)
NBS (No. of Bytes per Sector)

RDS = MNE * SEE / NBS

Use Table 1 and your answer from Task 3 to record the size of the Root Directory. What's the size (in sectors)?

5. Use your previous answers to determine the sectors for regions in the following Volume Map.

Note: In the diagram and table, regions are marked with letters so it'll be easier to refer to them as you continue this exercise.

6. What is the cluster number of the sector you identified in your answer above to the "K" region?

Hint: You may need to refer to your notes from class

Task 4: Find the starting cluster for each file

1. Navigate to the sector where the Root Directory starts.
2. Refresh your memory from Task 3 on the size of each directory entry (see your answer to Task 3.3).
3. Starting at the top-left, highlight the number of bytes that you had to your answer to Task 3.3. (This is the FIRST directory entry).
4. Locate the rows that begin with the filenames listed in Table 2 (Each row with a filename is the start of a directory entry).
5. Use the handout to record in the table below the Directory Entry offsets, which map to the properties in Table 2.

6. Remember: The offsets above are relative to the Directory Entry record.
7. Use your answers above to complete Table 2 below.

Task 5: Find the starting cluster for each file

1. Start by completing this data region table by using your answers from above:

2. Go to the sector where FAT1 is located and complete the following table.

Hints:

• The start of the FAT entry is F8 FF
• FAT entries/clusters are numbered/counted from 0 in the FAT table
• Each FAT entry is 2 bytes long

Table 3:

3. Examine the content of each of the clusters in Table 3.

Is there anything unusual about any of these files? If so, record your observation and interpretation in your contemporaneous notes.