Were in course 10.
Talking about the Ex-fat file system.
And in this module three we'll talk about the Ex-fat root directory.
The Ex-fat root directory has different types of directory entries in it.
Then these entries make up a directory entry set,
which we'll see as we go through this course.
One of the types of entries we have is a volume label entry and
this is going to tell us the user created volume label of the volume
that we're looking at and this is considered a critical primary directory.
It must be there.
Even if the user didn't create one, the entry will be left blank.
We also have a system file directory entries.
Now, system files are what we talked about the bit map which tracks the cluster
allocation, which clusters are in use in which clusters are available to be
written to and the up case table which handles the conversion of uppercase and
lowercase letters for searching purposes.
So those are our system files and
those entries are also considered critical primary entries.
Then we have our file directory entry and
this is going to give us some information about the file.
We're going to see that as we go through this course and
it is considered a critical primary directly also.
Then we have the extreme extension directory entry and
this is a critical secondary entry.
And then last but not least we have the file name, directory entry and
this is also a critical secondary directory entry.
Now the file director entry, the stream extension
directory entry in the file name directory entry of
the three entries that make up a file entry directory set.
Take a look at the volume label, directory entry and the slide shows what it
would look like when we're going to take a look at it and active disk editor.
Now this is how it would look to us in hexadecimal.
We have our entry type and the entry type is hex 83 [SOUND]
which tells us this is a volume label directory entry.
We have a character account which tells us how many characters
are in the name of this volume label and it says there are five and
then we have the volume label which is Ex-fat and
we can See it consists of five characters.
So that is the breakdown of how we would read the volume label directory entry.
Next we have one of those system files, the allocation bitmap entry.
This is considered a critical primary directory entry.
And it will begin with a hexadecimal 81 and
that lets us know what type it is that we are looking at a allocation
bit map directory entry, then we will have our flags
following that you can see highlighted in green on the slide.
In this case we don't have any flags but
if we did we need to break them this hexadecimal value out to buy a very and
see which bits were set to see which flags were on.
Then we have are starting cluster.
Our starting cluster in this case is 2,
all these values in excess fat are red little Indian starting
from the volume boot record to the directory entries.
They are all red little Indian.
So you see our first cluster is 2.
And this tells us that we have two clusters in the bitmap then we look down
and we can see our data length is the next value that we have and
that's highlighted in blue starting with hexadecimal B8 and
again that's red little Indian and
in this case our data length is 5000 816 Bytes.
Now we have our up case table and
this is the second system file that we talked about and
this is what converts are uppercase and lowercase letters for searching purposes.
It is considered a critical primary directory entry and
its entries type will start with a hexadecimal 82 and
that lets us know we're looking at a up case table directory injury.
We will have a table check some and this is for air checking and
that you can see is highlighted in yellow up above and
then we'll have the location of our first cluster and
that you can see highlighted in blue and
again that value is red little Indians so it would start in cluster 4.
And then we have the data length which again is
highlighted in pink and it starts with a hexadecimal CC.
And we convert that to decimal that value we get 5000 800 36 and
again these values are read little Indian.
The directory entry set,
directory record entry.
This directory entry record is going to track attributes, it's going to
have all our file dates and times in it are created access and modified times.
It will not have a pointer to its parent directory like we saw with other
versions of fat where we had the double dot, the first pointed to
itself the dot entry in the second double dot pointing to the parent.
We will not have that in expat.
We will have an added value in excess fat of something called a UTC,
Universal Time Code offset.
So are other fat versions told us our file times in local time and
we had a millisecond offset but we didn't have an offset
to the universal time code, in ex-fat we have that and
we will see how we read that value as we go down.
We're also going to have extreme extension and
with the stream extension tracks is attracts the size and where the file
starts the starting extent the file which would be the starting cluster.
It also tracks the size of the file name in the stream extension.
The file name directory entry contains the file name in Unicode.
So that's another thing that's different between Ex-fat and other versions of fat.
It's going to write the file name in Unicode like NTFS.
Whereas in fact 32 it was in asking, so
breaking this down a little more the file directory entry,
it is a critical primary directory injury.
All files will have this entry.
It's going to start with a hexadecimal 85 when it's in use.
When it's not in use, it's going to start with a hexadecimal 05.
And not in use means that the file has been deleted, and
now this directory entry is available to be written to in the root directory.
The next bite is going to tell us our secondary account.
And it must be a value between 2 and 18.
And what it means is that is how many more directory entries we have in this file
directory entry set.
There can be more than one file name directory entry and
there can be more than one file stream extension directory entry.
So we could have more than three.
In our case, we just have three.
Then we have a checksum for error checking and then we have our attribute byte.
And it's 2 bytes long for the attribute Red Little Indian.
And this is packed,
so we would have to break this out to see what attributes we had.
So when we break out hexadecimal 16, we could see it broken
into binary here on the slide, we have a hidden system directory.
Those are the attributes that are set.
Now we're going to move down to our creation time.
We have a creation date and time, we have a last modified date and time,
and we have the last accessed date and time.
Unlike FAT when we did not have that last accessed date and
time, we didn't have a time, we do in exFAT.
We still have the 10 millisecond offsets, and
we now have this new UTC, Universal Time Code,
offset, and that is highlighted in pink on the slide,
and it is in 15 minute increments.
And we're going to talk about how we translate that.
It is a 7-bit signed value.
So the time zone offset is a 7-bit signed integer.
And on the last slide, we saw that it was a hexadecimal, EC was the value.
Now, we know that we're going to have 8 bits in this byte,
so we break the byte out into binary.
The most significant bit, the bit furthest to the left, will get dropped and
the bit to its right will become the most significant bit.
Because this is a signed integer, we know it can be a positive or a negative number.
And how we know it's a negative number is the most significant bit is turned on,
it's a 1, you can see it up here in red.
So when we convert this to decimal, that will be a negative number.
So then the next thing you'd need to do is put down your column values,
you'd have 1, 2, 4, 8, 16, 32, and 64,
because we're only using 7 of the 8 bits.
We're not using the 128 value, which would be to the left
of the 64 if we had an 8 byte value, but it's 7 bytes.
So 64 is our highest value, and it is a -64.
So we'll drop our binary values into the columns.
And we have -64, we have positive 32,
we have a 0 in the 16, 1 in the 8,
1 in the 4, 0 in the 2, and 0 in the 1.
So we need to add -64 plus 32 plus 8 plus 4,
which gives us a -20.
That is our value, decimal -20.
But remember, this is 15 second increments.
So to get the total number of minutes, we need to multiply -20 times 15.
And when we do that, we get a value of -300 for
the total number of minutes.
Now, to convert 300 minutes into hours, you would divide -300 by 60.
And when we divide 300 by 60, we get a value of -5 hours.
So the total number of hours from UTC time would be -5.
So it would be UTC minus 5 for this particular time zone.
And that is correct because I did this in Central Time.
Now, our stream extension entry is a critical secondary directory entry.
And its entry type is going to be a hexadecimal C0 when it's in use and
a hexadecimal 40 when it's not in use,
meaning that the space is available to be written to.
We see our general secondary flags in our next byte, hexadecimal 03.
We'd break that out into binary and we'd get a 1,
1, a 1 and a 1, and a 1 and a 2 to make 3.
And we could see the first value is allocation possible, and
that must always be a 1, which means it's possible to be allocated.
And then the second value says not FAT chain,
meaning it doesn't have a FAT chain, and that is also turned on.
So we know if it doesn't have a FAT chain, it is not a fragmented file.
So our file is not fragmented.
Then we would have the name length,
this is how many characters are in the name of the file.
And in our case, there are 25 characters in the name of the file.
Then you have a name hash in hex.
And then moving down, we have a valid data length.
What that means is that is the initialized size.
If you've ever downloaded a file, your file system
will save a certain amount of space for that file.
And if it does not download all the way,
it may not take up all the size that your file system reserved for it.
And then your data length and your initialized size could be different.
But in our cases, they're not.
So we see our first cluster is cluster 7, and our data length is 4096.
And the data length is the actual size of the file.
So that's how we would interpret the stream extension entry.
The file name directory entry is also a critical secondary directory entry.
You can have more than one of these file name directory entries.
Each entry can hold up to 15 Unicode characters.
The entry type is going to be a hexadecimal C1 when it's in use,
and if it's not in use it will be a hexadecimal 41.
Then we would have our general secondary flags.
And again, it's a packed byte.
In our case, it is 00, you can see it highlighted in green.
And what this means is allocation possible,
0, and then no FAT chain and it must be 0.
You can see here both of these values must be 0.
And then underneath that we see our file name and it is system volume.
Now we're going to do a walkthrough of our root directory and
take a look at it with Active Disk Editor.
And see how these values are interpreted and
what the director sets look like on disk.
The items were going to need for
this walkthrough our Active Disk Editor and our exFAT VHD.
Okay let's start our walkthrough.
To start our walk through, the first thing we have to do is attach our exFAT VHD.
So we're going to go to actions, attach VHD,
navigate to where we saved our ex fat VHD.
My end is on my desktop.
I'm going to select it and hit open and then I'm going to go ahead and click okay.
And my VHD will mount.
Once your VHD mounts, make sure you make note
of the disk number and the drive letter.
Mine is disk 13, drive letter F.
Yours will probably be different than mine but note the volume letter.
Now launch Active Disk Editor.
Once Active Disk Editor launches, we're going to go ahead and select open disk.
Once that opens we're going to go to volumes.
Now we're going to select our exFAT volume.
Mine was F yours will probably be a different drive letter and
we're going to click open.
And we can see it will take us to the volume boot record.
And we talked about that in our last module.
I want you to go ahead and click on this button up top here next to
unicode that says browse file records.
Now when this opens up, we can see we have some file records up here.
We have our bit map, we have our up case and we have our volume label.
We also have the root folder.
First one we want to take a look at is the bit map.
This is our bit map directory entry and we talked about that.
It starts with a hexi decimal 8.1 which tells us our type.
So we know we are looking at a bit map directory entry.
Then we have a 00 next to that which tells us the secondary entry counts and
there are none because this is a bit map directory entry.
Then we have our first cluster offset 14.
So we'd go down line, one line in over four and
this tells us where our first cluster is and our first cluster is cluster 2.
So our bit map starts in cluster 2.
And then it's going to tell us the size, how big is our bit map,
our data length and we can see our data length is 5816 bytes.
Now let's take a look at the volume label directory entry.
This is our volume label directory entry and
again this is a user created volume label.
If the user did not create a volume label, you would just see all
zeros on the hex here but we did create a volume label so we have one.
Again, this tells us the type of entry.
The next bite over is going to tell us the character count,
how many characters are in the volume label.
And again this is expressed in unicode.
If you look to the right,
you can see that it's expressed in unicode.
Then we actually have the volume label and
it is five characters long.
Our next entry, we'll take a look at will be our up case.
Our up case entry, we start with the entry type which is a hex 82.
Moving over, we have our reserved bites in green here.
Now we have our checksum for error checking.
We have more reserved bites and then we have the location of it,
our first cluster.
And we can see that it starts in cluster four.
This is where up case table will start and then we have the size of
our up case table, the data length and that is 5836 bites.
Now let's take a look at the directory entries for we have two files up here.
So let's start with long file named TXT.
And we can see we have our hex 85 which this would be our entry type.
Now, how many entries are in our directory set?
We have three entries in our directory set.
It's the secondary count.
There's a check sum for error checking.
Our file attributes are 20.
Again, this is red little Indian.
So let's go take a look and expand file attributes and
take a look at which attributes are set.
And we can see that we have in archive attribute set.
So this is an archive.
We have a creation date and time, less modified date and time.
Last access date and a time [INAUDIBLE].
We have our creation 10 millisecond
offset which can be 0 to 199.
In our case it is 190.
Then we have our time zone offset.
This is the created time zone offset.
This would be the last modified time zone offset
in the last access time zone offset.
And we talked about how we would need to translate this bite.
It's a seven bit signed integer so you need to convert it to binary,
you're going to get eight bytes.
You would drop the bite furthest to the left,
the 8th bit coz it's only a seven bites that we're looking at.
And because it's a signed integer, if that seventh bit, it's a one.
If it's turned on, that would be a negative number.
Like we talked about in the power point presentation and
then the last of these bites are just reserved.
So that is the directory entry for this file.
But we know we have three in the directory set.
So moving down, we now have a directory stream name.
We can see the type is hexi decimal C0, which is the type for
our stream name, extend stream name attribute.
Next we have our Secondary Flags And
we can see we have a hex to decimal value of 03 So
we go ahead and use are flags,
we can see that allocation is possible but
that must always be a one as we talked about and
there is no fat chain.
So this is Not a fragmented file because the value is one
We have reserved by then we have the name length, how big the name is.
The name is 12 characters.
Hexi decimal 10.
Which would Translate to decimal 18 characters long.
Next we have our name hash in hexi decimal.
Next we have valid data length and
we talked about that is the initialized size of the file.
Now we have our first cluster location moving down
started with hexi decimal zero D highlighted in pink.
We have our starting cluster and we can see it is zero D.
This is red little indian and that would give us a hexi decimal
13 as the first cluster and then we have the length of the data
which is the husks of decimal 26 Which gives us a 38.
So it's 38 clusters.
Moving down to our next entry in our directory entry set.
We have a value of C1, you can go ahead and right click and set template position.
So you can follow along, We have our C1 which we know is our file name.
This would be our file name entry in our directory entry set.
We can have more than one of these so keep that in mind and
here is our file name and as we can see it is in unicode and
you can tell it's unicode Because you have that
padding of 00 between the characters.
And if we look to the left and the askey and in the unicode we
can see that we do have those dots in the middle as padding.
So this is written in unicode not asking.
And we do have more than one file name.
Directory actually because if you go down and go ahead and
set right, click and set template position,
we have a second entry here for the file name and it just has the TXT.
So this directory entry set has to
file names in it to file in entries.
And then below that we have something interesting.
We have something that starts with a 05 and
we talked about directory entry sets and
we talked about the directory entry going
back to our 85 If this were a not in use it would be a 05 So
this is a directory entry that is not in use.
We're going to talk more about when we talk about recovering deleted files.
This is a directory entry for deleted file and
you can see For the directory entry, it has a 05.
If we go down And we look at the stream extension,
it has a 40 and then we go down.
We can see that the file name has a 41.
So this is a completely deleted directory entry set.
And we'll talk about this in our next block when we
talk about the leading files and
what those entries look like and how we would recover files.