O'Reilly logo

EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition by Steve Bunting

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

FAT Basics

The first major component of the FAT file system is the directory entry. In all versions of the FAT file system (FAT12, FAT16, and FAT32), every file and directory is referenced and described in a separate directory entry. The directory entry is 32 bytes in length and contains the file’s or directory’s name, its size in bytes, its starting extent (or beginning cluster), and other file attributes or metadata (created, last-accessed, and last-written time stamps, and so on). None of the data content exists in the directory entry; rather, data content is stored in data allocation units called clusters. Clusters consist of one or more sectors, and a cluster is the smallest unit in which a file or directory can be stored. If a file’s size ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required