During a digital investigation in Seattle involving corporate espionage, you are analyzing a forensic image of a 32GB USB drive belonging to the primary suspect. The drive is formatted with the FAT32 file system.
The suspect claims they never possessed the stolen project files. However, while analyzing unallocated space using a hex editor, you discover a directory entry for a file named "PROJECT_X.DOC" that has been deleted. You need to manually locate the file's data payload on the disk to carve it out for further examination.
The hex dump displays a 32-byte FAT32 directory entry. The first byte is 0xE5, which is the FAT file system's marker for a deleted file. The entry contains vital metadata including timestamps, file size, and pointers to the data payload.
Examination & Analysis - The investigator is performing deep-level file system analysis (manual carving) on preserved digital evidence.
High-order and low-order word of the first cluster number. FAT32 uses a 32-bit (4-byte) value to address clusters. Because the legacy FAT16 directory entry only had a 2-byte field for the starting cluster (offsets 0x1A-0x1B), FAT32 split the 32-bit address. The high-order word is stored at offsets 0x14-0x15, and the low-order word is stored at 0x1A-0x1B. An examiner must combine these two words to determine the true starting cluster of the file.
When recovering deleted files from FAT32, automated tools (like Autopsy or X-Ways) automatically combine the high and low-order words. However, if the File Allocation Table is corrupted, an investigator must manually navigate to the directory entry in a hex editor, extract the bytes from 0x14-0x15 and 0x1A-0x1B, account for little-endian byte ordering, convert the combined hex value to decimal, and calculate the physical sector offset to begin data carving.
When a user deletes a file on a FAT system, the OS does not erase the file data. It simply changes the first character of the filename in the directory entry to 0xE5 (sigma) and zeros out the corresponding entries in the File Allocation Table. The starting cluster pointer in the directory entry usually remains intact. As long as the OS hasn't overwritten those unallocated clusters with new data, the original file can be fully recovered.
Sharpen your digital investigation skills with more practical simulations.
Explore more CHFI simulations