In this course, course 10,
we're covering the exFAT file system.
In this module, we're going to talk about
the exFAT volume boot record.
The exFAT volume boot record is located
at physical sector 0 of the volume.
It contains information about the volume.
The offsets you're going to see in
the table to the left of the slide are
relative to the start of the logical volume itself.
That would be like your C volume,
your D volume, your E volume.
They're not relative to the physical disk.
We can see, we have quite a bit of information and
the information highlighted in
yellow are the structures we're going to talk about.
So we see we can tell what file system we have.
You'll have the number of hidden sectors,
the number of total sectors.
We have our first FAT sector,
and we're going to see our total clusters,
the location of the root cluster
that will contain our root directory.
We'll have a volume serial number,
bytes per sector shift.
Now that means byte per sectors,
we'll talk a little bit about that in a minute.
Then we see below that sectors per cluster shift,
and what that does mean is sectors per cluster.
You're also going to see the number of FATs,
which will usually be one in exFAT,
and then we will have down at the bottom
our boot sector signature of 55 AA.
Now getting back to bytes per sector,
what you're going to see there is a value
between nine and 12.
It'll be in hexadecimal,
and this value is going to be two to the power
of whatever number we have between nine and 12.
It can be anywhere from 512 bytes per
sector to 4,096 bytes per sector,
and it's the same concept on the sectors per cluster.
You're going to have a number there that will
range between 0 and 25.
Again that number, it will be two to
whatever that number is
that you have between zero and 25,
and that can give us as many possible zeros.
It's somewhere between 1 and 33,554,432.
That's quite a large number of sectors per cluster.
But again, this file system is
designed for large volumes.
We're going to do a walk-through now of
the exFAT volume boot record.
The items we're going to need for
our walkthrough are we're going to need
active disk editor and our exFAT VHD, virtual hard drive.
Let's start our walkthrough.
The first thing we need to do is attach our exFAT VHD.
We're going to open up disk management,
we're going to go to Actions, attach VHD.
We're going to navigate out to where we
saved our exFAT VHD.
Mine is on my desktop.
We're going to select exFAT VHD,
we're going to click Open,
and then you're going to go ahead and click
Okay and your VHD will mount.
Once we've done that,
we're going to locate the VHD that we mounted.
It should be labeled exFAT.
For me, it's physical Disk 13,
logical drive F boot up volume level,
you can see here of exFAT,
and it's a 182 megabytes.
Make sure you have the correct drive,
remember the drive, the physical disk number,
and the logical drive letter.
Now let's go ahead and launch Active Disk Editor.
Once Active Disk Editor opens up,
we're going to select "Open disk."
Now we're going to select volumes.
Because we want to look at the logical volume,
and then we're going to select our exFAT file system.
Mine is right here, drive F,
you drive letter, will probably be different.
Once you've located it select it and
click ''Open,'' and it will open up.
Now, it takes us right to the volume boot record,
and we can see right at the top of
the volume boot record in the ASCII,
up here we see the words EXFAT,
and this is the type of
file system that we're looking at.
If you're not seeing what I'm seeing,
check your template to
make sure you're on exFAT boot sector,
and go ahead and right-click "Set Template
Position," and you'll be able to see that.
We have our jump instructions,
and then we have our file system here
highlighted in green, identified as exFAT.
Moving down, we can see we have our hidden sectors.
We have our total sectors.
Our hidden sectors are located right here.
If we look at the value of that,
we can see it's interpreted for us.
It's 32,768 hidden sectors.
Then we have our total sectors,
the total sectors on the drive.
We want to know that
because we want to be able to account
for all the space on the drive.
We can see that number is 372,736,
and it is located right here.
If we were to go ahead and highlight that,
and then take a look down at our hex interpreter,
we can see it is a 32-bit unsigned integer,
and we do have the same number of 372,736,
which is what we have up here also in our total sectors.
We can see that our tool is interpreting it correctly.
We have our first FAT sector.
This is where the FAT table is located,
the first sector of our FAT table,
and that's going to be sector 128.
We have the total number of sectors in the FAT table,
and that is 368 total sectors.
We also have our total clusters on the drive,
which is going to be 46,528.
Our root cluster is going to be cluster 6,
which is what we would expect it to be.
We have our serial number and hexadecimal over here.
This is where we have our bytes per
sector shift and our sectors per cluster shift.
Now, you can see are bytes per sector shift says nine,
so what we would have to do
is we're going to bring up the Windows calculator,
we're going to put it to scientific view,
and we remember it would be two to
the power of nine to find that number.
What we'd do is we'll do two and go to the x^y,
and then go to nine equals 512.
We have 512 bytes per sector.
Now when we look at our sector per cluster shift,
which is right next to it,
which is a three,
we'd do the same calculation.
We'd go two to the third power,
so it'd be 2, the x^y, 3 equals 8.
We have eight sectors per cluster.
Five-hundred-and-twelve bytes per sector,
and eight sectors per cluster,
and that would be how you would read
the sector and cluster shifts.
The number of FATs is one,
which is what you would expect to see in exFAT.
Then we have our signature down at the bottom of 55, AA.
That will conclude our walk-through
of the exFAT volume boot record.
In our next module,
we're going to take a look at the exFAT root directory
in how we interpret
the entries in the exFAT root directory.