CIT 255 - Advanced Computer Forensics

First sector of a FAT system is the boot sector.
Boot sector contains information that determines:
- file system type
- size and location of data structures
- (Note that boot sector format is different for FAT12/16 and FAT32.)
To find the first data cluster, you need to gather the following info:
- How many bytes are in one sector?
- R how many sectors are reserved?
- F how many sectors are reserved for each FAT table?
- D How many root entries are present in the rood dir area?
Assuming that sector size is 512 bytes and each directory entry is 32 bytes, use the following formula to calculate the first data cluster offset:
```
    R × 512  +  F × 512 × 2 + D × 32
```
Use desktop calculator to convert result to hexadecimal value.
Use WinHex Position menu -> Go to offset... and enter the hex location.

Each FAT area will look like this:

    F0 FF FF B9 40 7C FF FF FF FF FF ... "content"
             22 32 33 44 54 55 66 76 ... "ruler" for clusters 2, 3, 4, 5, 6, ...

First data cluster number is 2.
Use Position menu -> Go to FAT entry... and enter the cluster number you want.
The "ruler" above indicates which 12 bits belong to which cluster.
If cluster number is even (2, 4, 6, ...) then use an "abc" approach to construct the data:
```
    F0 FF FF B9 40 7C FF FF FF FF FF ... "content"
             bc za xy
            ^    |
            |    |
            `----'
```
- For example, cluster 2 data is x0B9 (decimal 185).

If cluster number is odd (3, 5, 7, ...) then use the "xyz" approach to construct the data:

    F0 FF FF B9 40 7C FF FF FF FF FF ... "content"
             bc za xy
                |    ^
                |    |
                `----'

The data can be interpreted as follows:
- x000 - Free Cluster
- xFF7 - Bad sector
- Any value in range xFF8 : xFFF - Last cluster in file (the end of cluster chain.)