EnCE EnCase Computer Forensics: The Official EnCase Certified Examiner Study Guide, 3rd Edition

FAT Basics

The first major component of the FAT file system is the directory entry. In all versions of the FAT file system (FAT12, FAT16, and FAT32), every file and directory is referenced and described in a separate directory entry. The directory entry is 32 bytes in length and contains the file’s or directory’s name, its size in bytes, its starting extent (or beginning cluster), and other file attributes or metadata (created, last-accessed, and last-written time stamps, and so on). None of the data content exists in the directory entry; rather, data content is stored in data allocation units called clusters. Clusters consist of one or more sectors, and a cluster is the smallest unit in which a file or directory can be stored. If a file’s size ...