In this course, Course 10,
we're going to be talking about the exFAT file system.
This course is going to cover
knowledge of critical data structures
in the FAT file system.
We're going to understand how
the FAT file does file recovery.
We're going to talk about the exFAT directory tree,
and folder, and file recovery
limitations within the FAT file system.
In Module 1, we're going to talk about
file system overview and
history of the exFAT file system.
exFAT was first supported by Windows CE in 2006.
It has a maximum volume size of 64 zettabytes.
That is a very large volume.
This file system was designed for large volumes.
It's file size limitation is 16 exabytes.
It's designed for large volumes and large files.
It's used mainly on external media,
it is cross-platform, it will run
on Windows, Mac, and Linux.
If you have a removable media that you
intend to use on different operating systems,
you would probably want to format that volume exFAT.
Now the volume structure,
we have a volume boot sector like we have in FAT,
we have a backup boot sector,
and we have one FAT.
We don't have the two FATs,
we only have one FAT in exFAT,
one file allocation table.
Then we have the data area,
which is also referred to as a cluster heap.
So we do have a system area and a data area.
The system area has our boot record,
our backup boot record,
and our file allocation table.
The data area is where we store our files and folders.
Now, we only have one FAT table.
This version of FAT does use
a full 32 bytes for its entries.
It's going to have a media descriptor of FF, FF,
FF, F8, and that is the same as FAT32.
The difference with FAT32 and exFAT is exFAT,
the file allocation table only tracks fragmented files.
If a file is not fragmented,
it won't have an entry in the file allocation table.
The file allocation table does
not track cluster allocation.
ExFAT uses a bitmap to track
cluster allocation like NTFS.
There are two system files we're going to
see in exFAT that we don't see in FAT32,
and that's the bitmap and the UpCase table.
The bitmap, like I said,
is used to track cluster allocation.
It tracks what clusters are in use,
and what clusters are available to be written to.
The UpCase table is just a table of unicode characters.
This is used for searching.
It converts the characters
so you can do a search of the drive.
The system files will
have an entry in the root directory,
but that directory entry does not have a filename.
We'll look at that when we look
at the exFAT root directory.
In our next module,
we're going to take a look at
the exFAT volume boot record.