Microsoft File Allocation Table

Transcription

1 Microsoft File Allocation Table CSC362, Information Security originally appeared in late 1970s for small disks with simple folder structures uses a FAT to index files (naturally) the original FAT- 12 gave way to FAT- 16, and later FAT- 32 modern computer systems with very large storage capacities have outgrown the FAT file system retained for flash drives and other solid state memory partition boot sector the file allocation table (FAT) the root folder, and clusters containing other folders and all files 1

2 Boot Sector contains information that the file system uses to access the volume on x86 systems, the Master Boot Record (MBR) uses the boot sector to load OS kernel files the BIOS (Basic Input/Output System) boot code is built into the computer system ROM and is executed when the system is powered on the BIOS selects the drive to boot from based on the order specified earlier by the user Boot Sector when a partition is selected, the loader checks the first sector to find the Volume Boot Record (VBR) serves as a table of contents for the partition s volume In 2015, a financially motivated threat group targeting payment card data used sophisticated malware that executes before the OS boots successfully FIN1, which is likely a Russian group, hatched the Nemesis attack to hijack the boot process, the malware uses a complex multi- step process to create a custom file system, which stores Nemesis components into the Windows kernel the bootkit attack attempts to take control of the system before it enters the protected mode 2

3 1. BOOTRASH creates its own custom virtual file system for Nemesis components 2. the malware uses Windows Management instrumentation to query the system s boot disk and partition 3. the installer reads boot sector into memory and saves an encoded backup to the VBR 4. the MBR loads the infected VBR, which executes the malicious code partition boot sector the file allocation table (FAT) the root folder, and clusters containing other folders and all files File Allocation Table resides at the beginning of the volume acts like a linked list of clusters, which is the smallest allocatable unit block size is fixed, but the number of blocks per cluster varies across versions FAT is located precisely from information stored in the VBR each FAT entry has a standard size: FAT- 16 (16 bits), FAT- 32 (32 bits) 3

4 File Allocation Table the table contains specific information about each cluster on the volume here is an example based on FAT- 16 unused (0x0000) in use (pointer to the next cluster) bad cluster (0xFFF7) last cluster (0xFFFF) File Allocation Table files are given a FCFS available location the starting cluster number is the address of the file s first data cluster each cluster contains a pointer to the next, or an EOF name (8 plus 3 characters extension = 11 bytes) attribute (8 bits) create time (24 bits) create date (16 bits) last access date (16 bits) last modified date (16 bits) starting cluster number in the FAT (16 bits, little endian) file size (32 bits, little endian) 4

5 the filename is shortened and the attribute code 0x20 indicates that it is a long filename the actual filename is Unicode, so it takes 16 bits per character SIDEBAR: Endianess FAT- 32 the last revision was FAT- 32, which was intended to accommodate HDDs with over 2GB of storage FAT- 32 can have a maximum file size of 4 GB and a 2 TB volume maximum Window s cluster sizes grow from 4 KB to 32 KB as the partition size increases Big- endian systems store the MSB of the value in the smallest address given; Little- endian systems store the LSB in the smallest address given. 5

6 Deletion to delete a file in the FAT system, the system locates the file directory entry and sets it to EMPTY, and frees the clusters used by the file it makes no further changes to the directory entry or the data clusters when a new file is created, the entry may be reused and the clusters will be overwritten when needed Undeletion it is possible, therefore, to recover lost data that has been deleted how could this be possible? Undeletion it is possible, therefore, to recover lost data that has been deleted how could this be possible? as long as the following conditions must be met the entry for the deleted file must still exist in the directory, and the clusters formerly used by the deleted file must not be overwritten Data Recovery a more drastic form of data recovery is also possible with many OS and hardware combinations it takes four steps repair the hard drive (if damaged) image the drive to a new drive perform a scan of the contents to recover the logical units that make up files, partitions, etc. repair the damaged files that were retrieved 6

7 Data Recovery it is also possible to recover data that has been erased or overwritten the most publicized approach is to capture the analog signal obtained from the drive s read/write head prior to it being digitized using a subtraction process, it is possible to amplify the difference signal to determine what had been previously written to the disk Data Recovery Gutman/Plumb have contended (and endorsed by the DOD) that a disk overwritten with 35 different randomized patterns cannot be deciphered some have argued that it is still theoretically possible to recover data from a disk even if it has been randomly overwritten hundreds of times neither side of the debate have produced any compelling evidence MORAL: if the data is important, archive it. If you want to destroy it, damage the disk physically and do not depend on erasures Final Thoughts FAT file systems are very common. Even so, there are some shortcomings file size is limited to 4GB or less older FAT systems cannot recover from drive errors in essential locations in the root directory its linear organization makes it slower when searching very large directories FAT files don t identify owners FAT files can t support some access restrictions beyond simple flag bits 7