Title: 2. Exploring Microsoft File Structures
Course: IN 2005 Digital Forensics > Section: Module 6: Chapter 6 - Working with Windows and DOS Systems

Exploring Microsoft File Structures

1. In Microsoft file structures, sectors are grouped to form clusters, which are storage allocation units of one or more sectors.
2. Clusters are typically 512, 1024, 2048, 4096, or more bytes each. Combining sectors minimizes the overhead of writing or reading files to a disk.
3. Clusters are numbered sequentially starting at 2 because the first sector of all disks contains a system area, the boot record, and a file structure database.
4. The OS assigns these cluster numbers, which are referred to as logical addresses. Sector numbers are referred to as physical addresses. Clusters and their addresses are specific to a logical disk drive, which is a disk partition.

Disk Partitions

1. A partition is a logical drive. FAT16 does not recognize disks larger than 2 MB, so large disks have to be partitioned into smaller sections.
2. Hidden partitions or voids are large unused gaps between partitions on a disk drive.  A partition gap is the unused space between partitions.  A disk editor utility could be used to alter information in the disk’s partition table to hide a partition.
3. One way to examine a partition’s physical level is to use a disk editor, such as Norton DiskEdit, WinHex, or Hex Workshop.  The tasks involve analyzing the key hexadecimal codes the OS uses to identify and maintain the file system.  See Table 6-1 .
4. See Figure 6-4 to show how to use Hex Workshop to identify file systems.
5. With tools such as Hex Workshop, you can also identify file headers to identify file types with or without an extension.  See Figures 6-5 and 6-6 .

Master Boot Record

1. On Windows and DOS computer systems, the boot disk contains a file called the Master Boot Record (MBR), which stores information about partitions on a disk and their locations, size and other important items.
2. Several software products can modify the MBR, such as PartitionMagic’s Boot Magic.

Examining FAT Disks

1. File Allocation Table (FAT) is the file structure database that Microsoft originally designed for floppy disks. It was used on file systems before Windows NT and 2000.
2. A FAT database is typically written to a disk’s outermost track and contains filenames, directory names, date and time stamps, the starting cluster number, and file attributes.
3. The following are versions of FAT:
  - FAT12
  - FAT16
  - FAT32
  - VFAT
4. Cluster sizes vary according to the hard disk size and file system. See Table 6-2 .
5. Microsoft OSs allocate disk space for files by clusters. This practice results in drive slack, which is composed of the unused space in a cluster between the end of an active file and the end of the cluster.  Drive slack includes RAM slack and file slack. See Figure 6-7.
6. An unintentional side effect of FAT16 having large clusters was that it reduced fragmentation as cluster size increased.
7. When you run out of room for an allocated cluster, the OS allocates another cluster for your file, which creates more slack space on the disk.  As files grow and require more disk space, assigned clusters are chained together.  The chain can be broken or fragmented.  See Figure 6-8.
8. Ehen the OS stores data in a FAT file system, it assigns a starting cluster position to a file.  Data for the file is written to the first sector of the first assigned cluster.  When this first assigned cluster is filled and runs out of room, FAT assigns the next available cluster to the file.  If the next available cluster isn’t contiguous to the current cluster, the file becomes fragmented.

Deleting FAT Files

1. In Microsoft OSs, when a file is deleted, the directory entry is marked as a deleted file with the HEX E5 (σ) character replacing the first letter of the filename and the FAT chain for that file is set to 0.  The data in the file remains on the disk drive.
2. The area of the disk where the deleted file resides becomes unallocated disk space. This space is now available to receive new data from newly created files or other files needing more space.