See Disks

Also see COMP3231/file-systems

FAT32

Boot Record

Always located on the first sector

File Allocation Table

Example


Two redundant tables

Directory Entries and Data

Deleted Files

NTFS

See https://www.youtube.com/watch?v=l4IphrAjzeY



Key notes

  • $BITMAP does not track the next cluster, just the 'in-use' state


Notes

  • Files can actually be stored in the MFT itself - and is known as Resident Data
    • The resident data may not be fully zero'd out when it overgrows its size
    • 🔥


Alternate Data Streams

Deleted Files

Slack

Key notes

  • If you wipe unallocated space, it may not wipe the slack space that exists within allocated space

Unallocated Clusters