HTCIA International Conference September 20-22, 2010 Atlanta, GA Demystifying the Microsoft Extended File System (exFAT) Robert Shullich CPP, CISSP, CISM, CISA, CGEIT, CRISC, GSEC, GCFA September 20th, 2010 1 Agenda About Me Why a new file system Forensics Relevance Features Advantages Timelines Support Limits ItInternal s September 20th, 2010 2 About Me I have been in the IT field for 35+ Years, and in InfoSec for over 15 Years I carry many IT and InfoSec certifications This research was part of a term project for a forensics class for my masters in Forensic Computing I then expanded the term paper into a practical paper for my SANS GCFA certification A link to the SANS paper and my blog is at the end of this presentation September 20th, 2010 3 Why do we need a new file system? Current Limits Exhausted Larger volumes (>2TB) Largg()er files sizes (>4GB) Faster I/O (UHS-1: 104 MB/2 - UHS-2: 300MB/s) Removable Media Flexibility Extensibility NTFS Features without the overhead September 20th, 2010 4 Relevance to Forensics Study Digital Evidence Extraction Finding the evidence Including the hiding places Validation Daubert Expert Testimony Need to know and understand file org New Media (SD Cards) will drive exFAT adoption, and the potential for CP investigations. September 20th, 2010 5 What happens when you have exFAT fddidAformatted media and no exFAT support ? September 20th, 2010 6 Forensics Challenges Linux OS Support Tuxera drivers may help Mac OS Support Open Source Tools Commercial Tools Encase FTK Documentation September 20th, 2010 7 Disclaimer The released specification and implementation is Release 1.00 of exFAT The specification mentions additional features that were not implemented yet, but may at a future time/ Some of these are Windows CE holdovers Both may be presented today Some directory entries will be skipped September 20th, 2010 8 Exponents 102 = 10 times 10 = 100 103 = 10 times 10 times 10 = 1000 (1K) 22 = 2 times 2 = 4 29 = 2*2*2*2*2*2*2*2*2 = 512 210 =2= 2222222222*2*2*2*2*2*2*2*2*2 = 1024 (1K) 212 = 2*2*2*2*2*2*2*2*2*2*2*2 = 4096 September 20th, 2010 9 International System of Units (SI) Table File System in Shorthand Longhand Nth Bytes powers of 2 KiB Kibibyte 210 1024 Device MiB Mebibyte 220 1024 KiB characteristics in power of 10 GiB Gibibyte 230 1024 MiB TiB Tebibyte 240 1024 GiB PiB Pebibyte 250 1024 TiB EiB Exbibyte 260 1024 PiB ZiB Zebibyte 270 1024 EiB YiB Yobibyte 280 1024 ZiB September 20th, 2010 10 Features of exFAT 1 .00 Sector sizes from 512 to 4096 bytes Clusters sizes to 32MiB Root Directory Unlimited Subdirectories to 256MiB Built for speed , less overhead than NTFS but has some of the NTFS features UTC Timestamp Support Vista/Server 2008 SP2+, XP with KB September 20th, 2010 11 Features of exFAT 1 .00 (cont ’d) OEM Parameters Sector for device dependent parameters 12 sector VBR,,pp support of lar ger boot program Potential cappyacity to 64ZiB Current support ≈ 128 PiB Upp,, to 2,796,202 files p er subdirector y File Names max to 255 Characters Unicode File Names and Volume Labels September 20th, 2010 12 Future Features of exFAT TexFAT (To be released later) Exists in Windows CE Transaction Safe exFAT ACL (To be released later) Exists in Windows CE Encryption Support? Not announced, but mentioned how easy to add September 20th, 2010 13 MBR Partition Limitations Microsoft File Systems are limited when stored in a MBR partition A ppyartition is defined by a Master Boot Record A MBR uses a 4 byte value for number of sectors To get the maximum volume size, exFAT cannot be created within a partition September 20th, 2010 14 Advantages of exFAT Handle growing capacities in media, increasing capacity to >32 GB. > 1000 files in a single directory. Speeds up storage allocation processes. Breaks file size 4 GB barrier. Suppor ts i n teroperabilit y w ith fu ture des ktop OSs. Provides an extensible format. Large cluster sizes September 20th, 2010 15 Disadvantages of exFAT Not all Windows CE features implemented No direct conversion to or from other FS Cannot use CONVERT command to NTFS No Floppy Support Mostly a Microsoft Desktop and Server World No Support for Older MS systems No Support for Non-MS systems No XBOX, PS3 or other special devices September 20th, 2010 16 Key Dates for exFAT September 2006 – Windows CE 6.0 Marc h 2008 – Win dows Vista Serv ice Pac k 1 January 2009 – Announcement at CES of SDXC specification January 2009 – Windows XP Drivers Available May 2009 – Windows Vista Service Pack 2 August 2009 – Tuxera Signs File System IP Agreement with Microsoft March 2009 – Pretec Releases first SDXC Cards December 2009 – Microsoft (re)announces exFAT license program for third-parties December 2009 – SDXC laptops due soon Decem ber 2009 – Diski n terna ls re leases ex FAT recovery u tility December 2009 – Encase support September 20th, 2010 17 More Key Dates for exFAT December 2009 Sony, Canon & Sanyo License Januaryy() 2010 Funai License (LCD TV) February 2010 Panasonic License February 2010 Panasonic 64/48GB SDXC February 2010 Sony Memory Stick XC February 2010 Sandisk Ultra XC 64GB Card 3.0 Spec $350 September 20th, 2010 18 More Key Dates June 1st 2010 Tuxera Releases Linux & Android exFAT drivers June 3rd 2010 Kingston Releases Class 10 SDXC 64GB Card 60 MB/s read, 35 MB/s write. September 20th, 2010 19 SD Card Association New Memory Card Consumer Appliances Follows SDHC Specification for 2TB Capacity September 20th, 2010 20 September 20th, 2010 21 SDXC Storage Capabilities From 32GB to 2TB on a card Exclusively exFAT File System 300 MB/s I/O Transfer Storage 4, 000 RAW images 100 HD movies or 60 hours of HD recording 17,000 fine-grade photos in a single directory September 20th, 2010 22 Support for exFAT Windows XP & Server 2003 KB955704 (requires SP2 or SP3) Vista & Server 2008 SP1 Vista & Server 2008 SP2 (Adds UTC timestamp support) Windows 7 September 20th, 2010 23 Reference Standards Bits are numbered right to left 76543210 Decimal Offsets (zero based) Little-Endian numbers Unsigned numbers Sectors vs. Clusters Strings are 16 bit Unicode Strings not Terminated September 20th, 2010 24 Endian Numbering order may vary based on processor type, is determined by the order the data bytes are read from the register. A 32 bit number is read as 4 8 bit bytes If I have the number 0x01 02 03 04 Big-Endian will store it as: 0x 01 02 03 04 Little-Endian will store it as: 0x 04 03 02 01 September 20th, 2010 25 File System Integrity Version Verified 3 Checksums VBR UP-Case Table File Set Critical Directory Entries Other Checks and Balances File System should NOT mount if failures September 20th, 2010 26 exFAT Limits Volume size 128PiB MS said 64ZiB MS now says 256TiB File Size 16 EiB (64 bit number) Bigger than volume size Subdirectory 256MiB Sector 512-4096 bytes (29-212) Cluster 32MiB (225) No floppy support No FAT32 minimum cluster (65,525) restriction No 8.3 file name support September 20th, 2010 27 Data Hide Alert! FAT32 max cluster 32KiB exFAT max cluster 32MiB This is an increase of 1024 fold Potential for massive slack space September 20th, 2010 28 Volume Space Layout The Main Boot Region Contains main VBR The Backup Boot Region Contains backup VBR The FAT Region Contains FAT Table(s) The Data Region (Cluster Heap) This is where data resides September 20th, 2010 29 September 20th, 2010 30 VBR – Volume Boot Record Contains 12 sectors 1 sector main boot sector Jumpp(y) Code (3 bytes) BPB (BIOS Parameter Block) Boot Strap Code 8 sectors main extended boot sectors 1 sector OEM parms 1 sector reserved 1 sector VBR Checksum September 20th, 2010 31 Boot Parameter Block (BPB) OEM Label “EXFAT ” Volume Length (64-bit) [sector] FAT Location & Size [sector] Heap Location & Size [sector, cluster] Volume Serial Number Location of Root Directory [cluster] Volume Flags Sector and Cluster Sizes [2-shift] Percent in use File System Revision (0x0010=1.00) September 20th, 2010 32 Sectors & Clusters A2A 2-Shift is a power of 2 Another name for exponent Sector size and sectors per cluster Each stored in 1 byte Theoretical maximum is 2255 Sector Size Maximum 212 Sectors per cluster is derived Cluster Size Maximum is 225 September 20th, 2010 33 Executable Boot Code First 3 bytes of Main Boot Sector Jump Code 0xEB7690 Offset 120 size 390 Remainder of boot code Offset 510 End signature marker 0x AA55 = “55AA” Offset 512 Unused if defined September 20th, 2010 34 More Bootable Code Up to 8 Main Extended Boot Sectors FAT32 had 3 sector VBR with 1 MEBS Entire sector can be used for boot code Last 8 bytes of sector is marker 0xAA550000 = “000055AA” Larger capacity for boot virus! September 20th, 2010 35 VBR Checksum Sector The 12th sector of the VBR Repeating 4 byte checksum Checksum of previous 11 sectors Flags and Percent excluded These are volatile and change often Boot Sector Virus & Checksum September 20th, 2010 36 VBR Checksum Sector Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 00000010 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 00000020 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ .‹ ÉÐ.‹ ÉÐ.‹ 00000030 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 00000040 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ Lines 00000050 througgph 01BF repeated 000001C0 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 000001D0 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 000001E0 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ.‹ÉÐ.‹ÉÐ.‹ 000001F0 C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B C9 D0 18 8B ÉÐ.‹ÉÐ .‹ÉÐ .‹ÉÐ .