SANS Digital Forensics and Incident Response Blog: Author - hammjd

Windows MBR and Advanced Format Drives (e512)

Advanced Format Drives (e512)

Advanced format drives are now on the market in full force. These drives are also known as e512 drives. They include the new Long Data Sector standards recommended by International Disk Drive Equipment and Materials Association (IDEMA). These are also known as the 4k - or 4096 - byte sector drives. Fortunately for legacy reasons, the drives are handling the sectors with drive controllers and electronics by emulating 512 byte sectors (hence the term e512). The various OSes and applications out there are going to see sector sizes as 512 bytes. It turns out this is not a major game changer for forensic examiners - unless you're really getting into rebuilding a drive physically.

That said, there is an area of change that should be noted. Some legacy artifacts have changed with the way these drives are now formatted. Specifically, the Master Boot Record (MBR) method of partitioning a drive has changed with Windows 7. Until

... Continue reading Windows MBR and Advanced Format Drives (e512)


exFAT File System Time Zone Concerns

exFAT Time Zone Concerns

The exFAT file system tracks the time zone offset of all MAC time's stored for the respective file. The file system uses 32-bit time stamps (and another byte tracking 10ms increments). Additionally, all time stamps are recorded to the file system as local machine time while applying a time zone offset that is also stored when a file is changed/modified/accessed. The implications of this include being able to track removable media across several time zones without the need for the system they were used in. (For a more detailed look at the exFAT file system, see Robert Shullich's paper on SANS Computer Forensics Resources).

exFAT stores time zone offsets in a one byte value. Vista SP1 (the first desktop release of exFAT) did NOT utilize the time zone byte. In this case, the time zone bytes will be 0x00. Since the OS

...