June 2016
Beginner to intermediate
322 pages
6h 18m
English
Content preview from Practical Windows ForensicsBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
The FAT filesystem
FAT or File Allocation Table became famous with the announcement of the DOS operating system from Microsoft in 1980. After this, FAT went through many improvements trying to make it adapt with the rapidly improving technology. So, we can see FAT12, FAT16, FAT32, and exFAT. Each version overcame some of the limitations of the filesystem until the announcement of NTFS filesystem.
FAT components
FAT partition contains five main areas. They comprise the following:
- Boot sector: This is the first sector of the partition that is loaded in memory. If this partition is the active partition, it contains information such as, but not limited to, the following:
- Jump code: This is the location of the bootstrap and OS initialization code
- Sector ...