In my class we are discussing the FAT partition table and the BIOS Perimeter Block (BPB). For our introduction to it we had to manually process the BPB/MBR and determine a few things, such as the number of bytes per sector, how many sectors per cluster, and determining if the FAT is FAT12, FAT16, or FAT32.

While not a difficult thing to do using forensics tools, there may instances where portions of the FAT may be corrupted and a manual decode would be necessary. For our purposes, we were given the data structure which provided the bytes, length, and what it represents. However, in practice counting each byte group and trying to keep track of your position can be quite bothersome. To alleviate this problem I turned the position in bytes into its hex offset (0x0D for example). I did this because the hex editor we are using is gHex for Linux and it displays the offset of the byte(s) you’ve selected. I wanted to share this with you, and hope it helps.

The following table information was obtained from “File System Forensic Analysis, Brian Carrier, Addison-Wesley” chapter 10. My contribution to this data is the hex offset, the rest belongs to the author.

[table id=1 /]

Book author’s note:
[1] My testing has shown that for file systems in an extended partition, Windows sets this value based on the beginning of the extended partition, not the beginning of the disk.