FAT32 is making a comeback: are forensic tools ready?

A long-standing Windows behavior could cause digital forensic tools to overlook recoverable deleted files. Our colleague Frank Kolenbrander has been investigating the issue and highlights why it deserves renewed attention as larger FAT32 volumes become easier to create. 

An old file system, a new forensic challenge
FAT32 may seem like an unlikely topic in today's digital forensics landscape. Yet, with Microsoft removing the traditional 32 GB FAT32 formatting limit in newer Windows 11 Insider builds, this long-established file system deserves another look.

Although FAT32 has supported larger volumes for years, Windows traditionally restricted their creation through its built-in formatting tools. Making larger FAT32 volumes easier to create could increase the likelihood of investigators encountering them during digital forensic examinations.

Larger volumes also introduce practical challenges. More available storage can mean that deleted data remains untouched for longer, while locating and recovering deleted files can become more complex.

But storage capacity is only part of the story. A lesser-known Windows behavior may also affect the recovery of deleted FAT32 files.

When two bytes make a difference
When a file is deleted from a FAT32 volume, its directory entry is marked as deleted and its allocated clusters are released in the File Allocation Table.

However, Windows performs an additional operation: it clears the high-order word of the file's starting-cluster address in the directory entry.

Consider a file originally stored at cluster 65,540, represented in hexadecimal as 0x00010004. After deletion by Windows, the high-order word is cleared, leaving 0x00000004.

The remaining starting-cluster value now points to cluster 4 rather than the original location at cluster 65,540.

The original file data may still be present on the storage medium. Nevertheless, forensic software that relies on the remaining starting-cluster value may search the wrong location and incorrectly report that the deleted file has been overwritten or cannot be recovered through that method.

This creates a potentially significant challenge for digital investigators: data that remains physically available may be overlooked because information required to locate it has changed.

Why conventional file carving may not be enough
File carving can help recover deleted files by identifying recognizable file signatures within raw data. However, this approach has limitations.

Depending on the file type and recovery method, carving may not preserve important metadata such as the original filename, timestamps and exact file size.

It can also be less effective when dealing with plain-text files that lack distinctive signatures or when investigators need to examine data beyond a file's expected end.

For forensic investigations, recovering a file's contents is not always enough. Context and metadata can be essential to understanding the evidence and establishing its relevance.

Alternative recovery techniques may therefore be necessary when conventional methods fail.

Demonstrating the issue with FAsTHOBBITSanalyzer
Frank investigated this behavior and demonstrated it using his own proof-of-concept software, FAsTHOBBITSanalyzer.

The demonstrations illustrate how the altered starting-cluster address can affect deleted-file recovery and why investigators should be cautious when interpreting the results produced by forensic tools.

Video 1: FAsTHOBBITSanalyzer recovery demonstration
This demonstration shows the proof of concept in practice and explores the recovery implications of the Windows FAT32 deletion behavior.

Video 2: Demonstration using a 64 GB USB drive
This video illustrates the issue using a 64 GB USB drive, providing a practical example of how the behavior can affect the recovery of deleted files.

The FAsTHOBBITSanalyzer software is not commercially available. Frank is willing to share the underlying research, techniques and knowledge with interested researchers and forensic professionals.

Raising awareness across the forensic community
Frank has presented his findings at a Digital Experience event and at the Dutch Police's monthly DEX event.

The research has also attracted interest from two universities of applied sciences, which have approached him about further research. Frank intends to bring the findings to UCD's attention for its FCCI training programme. 

In addition, forensic software vendors who attended the conference have been contacted. They indicated that they would investigate the issue and take action where necessary. Frank has offered to share his findings and recovery techniques to support these efforts.

These discussions highlight the importance of collaboration between researchers, forensic practitioners, educators and software developers when addressing challenges that may affect the reliability of digital investigations.

What does this mean for digital forensic investigations?
As larger FAT32 volumes become easier to create, understanding the details of file deletion and recovery becomes increasingly important.

A deleted file reported as overwritten by a forensic tool is not necessarily beyond recovery. Investigators may need to consider how the file system's metadata was modified, how the starting-cluster address is interpreted and whether alternative recovery methods could reveal data that conventional approaches miss.

The key question is whether forensic tools adequately account for the cleared high-order word when recovering deleted FAT32 files.

For the digital forensics community, this is an opportunity to revisit an established file system, examine the assumptions built into existing tools and help ensure that potentially valuable digital evidence is not overlooked.