file systems && autopsy

• File Allocation Table (FAT)
• Directory Entries (DE)

FAT: linked list of statuses of all clusters

Deleted files

• what happens to file contents when a file is deleted
• what else happens (specifically in FAT?)

Deleted files

• what else happens (specifically in FAT?)
  • first character in filename changed to 0xe5
  • all clusters in FAT replaced with 0x00

why are these important

• $MFT (DEs of NTFS)

• $BITMAP (FATs of NTFS)

• Everything is a file™

• Everything in a file is an attribute

Extents

• Similar to Cluster Runs
• A contiguous area of storage reserved for a file

Alternative data streams

• Also a file attribute
• Honestly pretty stupid, not honored by other FSs
  • Originally used to provide compatibility with Macs
  • Now mostly used to hide malware lol

read more here

Deleted files

• what happens for NTFS

Deleted files

• what happens for NTFS
  • $MFT marks $FILE entry as available
  • $DATA attribute read, $BITMAP updated to show cluster runs no longer used
  • nothing is wiped/deleted from $MFT or clusters

until the FILE entry is overwritten, the data is still there

TODO

TODO