Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

COMP40100_ComputerForensics > File Systems > Flashcards

File Systems Flashcards

1
Q

What is a File System

A

A set of structures that is used to control how information is stored on a disk

Without a file system, no idea when one information ends and the next begins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Common File System types

A

Hard Disk, Optical Disk, Tape Drive / Magnetic Tapes, Network FS: file systems accessed over the network, files distributed throughout the network (mapped network drive), ensure user does not realize it is a form of network

User FS: file systems which exist temporarily in user space, dynamically on the fly and maintained in RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are some HDD file system types

A
  • FAT: early Microsoft file system, nearly every operating system supports it
  • NTFS: new technology file system, introduced in Windows NT, standard FS on windows machines
  • ReFS: resilient file system, new file system for Windows,
  • EXT: standard on linux machines
  • HFS/APFS: hierarchical file system, apple file system
  • Optical: ISO 9660, universal disk format (UDF)
  • Flash: Overlay FS, LogFS, F2FS
  • Tape: Linear tape file system
    -Network: NFS (network file system), SMB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Describe a FAT file system

A

FAT - File Allocation Table

FAT12: 1980
FAT16: 1984
FAT32: 1995 - 2^28 of max space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the components of a FAT file system

A

Boot Sector - beginning of partition / contains information on disk geometry (# sectors/cluster)
Root Directory - for every file/folder the RD contains metadata for the file and pointer to beginning of files content
FAT1 &2 - copies of the FAT, which shows which shows the clusters a file occupies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the structure of a FAT file system

A
  • Boot Sector: Sector 0
  • FAT 1: Begins at the Number of Reserved Sectors
  • FAT 2: Reserved Sectors + Num sectors / FAT
  • Root Dir: FAT 2 start + Num sectors / FAT
  • Data Area: Root Dir start + (32 bytes * Number of files in root directory)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How can you examine the Boot sector to understand the FAT structure

A

Number of reserved sectors: 0x0E -> 0x0400 -> (LE) -> 0x04 = 4 sectors, FAT 1 starts at sector 4

Number of sectors in FAT structure: 0x16 (2 bytes) -> 0x2000 -> (LE) 0x20 = 32 sectors in FAT

Max number of entries in root directory = 0x11 (2 bytes) = 0x0002 -> 0x0200 -> 512 entries in root directory

Each entry is 32 bytes in length in root directory - true for all FAT boot sector

512 entries * 32 bytes / entry = 32 sectors

Data Area starts at sector 100 (68 (end of FAT2) + 32 (size of root directory))

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to create a file in FAT

A
  • Locate root directory / FAT from Boot Sector
  • Locate dir1’s starting cluster in the root directory
  • Add entry to dir1 for file1.txt (add metadata)
  • Find an area of unallocated space in FAT
  • Set the starting cluster in the directory entry
  • Add the correct chain to the FAT table
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Explain how to delete a file in FAT

A
  • Locate Root Directory / FAT in Boot Sector
  • Locate dir1 in Root Directory, get starting cluster
  • Find file 1 entry in dir1 cluster
  • Set FAT entries for file 1 to 0
  • Change first character of filename to 0xE5
  • Metadata is there, just clusters are flagged as unallocated
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain how to rebuild a File / Directory in FAT

A
  • Locate root directory and FAT using Boot Sector
  • List all files in Root Directory
    ○ Check each file’s attributes
    ○ If directory, extract contents of directory using starting cluster and FAT
  • Interpret directory like its root directory
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the benefits of exFAT

A

Larger volumes, files, number of files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the file structure of exFAT

A

Main region Boot (volume boot record and boot code)
Backup Boot region (backup of VBR)
FAT Region (FAT 1 and FAT 2)
Data Region (Data area)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Where is the Boot Sector located in exFAT

A

Sector 0, Backup copy stored in sector 12

All data stored in LE unless otherwise stated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Parse the following exFAT Boot Sector

eb76 9045 5846 4154 2020 2000 0000 0000

A

Value in hex is 2 to the power of number in hex (i.e. 0x05 = 2^5)

  • Bytes in each sector:0x09 = 2^9 = 512 bytes per sector
  • Sectors in each cluster: 0x03 = 2^3 = 8 sectors
  • # of FATs: 0x01=1 = 1 number of FAT
  • FAT 1 begins: 0x50 = 0x80000000 (LE) = 0x80 = 128 sector
  • FAT Length: 0x54 = 0x80000000 (LE) = 0x80 = 128 sectors in each FAT
  • Data region starts at end of FAT, only 1 FAT with length 128 that starts at sector 128
  • Data Region: 128 +128 = 256
  • Cluster of Root Directory: 0x60 = 0x05000000 (LE) = 05 = starts at cluster 5
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you rebuild a directory structure in exFAT

A

Access the Root Directory

Extract all file / file name entries

Check file’s attributes
- if its a file, list the name
- if its a folder, extract contents and process each extracted directory / file name repeating above steps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Explain the HFS+ file system structure

A

Reserved Area ( 2 sector area letting operating system know its a GPT partition)
Volume Header (boot information)
Allocation Block/Data Area (Allocation File, Catalog File, Extents Overflow File, Attributes File)
Copy of Volume Header (for redundancy checks)
Reserved Area

17
Q

What is the Allocation area in HFS

A

area between volume headers

18
Q

What is the Allocation File in HFS

A

provides block allocation bitmap of files on file system (bitmap in NTFS)

19
Q

What is the Extent Overflow File in HFS

A

if file has more than 8 extents of data, this will be used to store remaining contents of file

20
Q

What is the Catalog File in HFS

A

Similar to MFT in NTFS, record for every file and folder on FS, each file/folder is identified by CNID, stores metadata, and first 8 extents of file

21
Q

Explain the features of APFS storage

A

Containers - stores logical volumes
Space Sharing - allows volumes to reside in same container and share free space
Snapshot - Copy of file system at a specific point
Encryption options - none, volume disk encryption, or multiple key encryption

22
Q

What are some features of HFS File / Folder Names

A

Can hold up to 255 characters

Names are case sensitive

Data is stored in extents (similar to run lists, can be fragmented)

Files/Folders identified by CNID (Catalog Node ID)

COMP40100_ComputerForensics (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions