Learn · File systems in hex

Reading a disk byte by byte

Forensic tools show you files and folders. Underneath there are only bytes. These pages take the common partition tables and file systems apart, one structure at a time, on real sample disks.

1 Three layers

New to hex, little-endian numbers, sectors and clusters? Start with the Storage Foundations guide and its exercises; these pages assume them.

A storage device is one long array of bytes. Three layers of structure sit on top of it:

Disksectors 0 … n−1
Partition tableMBR or GPT: where each partition starts and how long it is
File system (volume)FAT32, ext4, NTFS, …: which bytes belong to which file, names, times, folders

Every structure on these pages is found the same way: a number in one structure (a start sector, a cluster, a block, an inode number) tells you where the next one is. Learn the chain for each file system, and you can find any file by hand.

Forensic habit: always write down offsets with their unit. "Sector 2048", "cluster 5" and "byte 0x100000" can all mean the same place, and most mistakes come from mixing them up.

2 The pages

Every page has interactive hex views. Click a field to see its bytes, click a byte to see which field it belongs to, and follow the → rows to jump to the structure they point to.

Partitions: MBR, EBR, GPTWhere volumes start and end, logical partitions, GUIDs and CRC32 checks. FAT32Boot sector, the File Allocation Table, directory entries, long names and deleted files. ext4Superblock, block groups, inodes with extents, directory entries hidden in slack. NTFSBoot sector, the Master File Table, attributes, resident data, data runs and alternate data streams.

3 Deep-dives

The same byte-level approach, applied to the files and devices you meet once the file system is understood.

Multimedia forensicsJPEG and PNG structure, TIFF/IFD and EXIF parsing, error level analysis, thumbnails, appended payloads, steganography and device attribution. Mobile forensicsiOS and Android acquisition and backups, the SQLite file format, recovering deleted chats from freeblocks and the WAL, location history. Network forensicsPacket captures byte by byte, DNS, HTTP and TLS, flows, log formats and time zones, e-mail headers, and the SIEM method with a small SIEM to practise on.

4 At a glance

FAT32ext4NTFS
Starts withBoot sector with BPB, "FAT32" text at 0x52Superblock at byte 1024, magic 53 EF at 0x438Boot sector, "NTFS" at offset 3
File metadata32-byte directory entryInode (usually 256 bytes) in the inode tableMFT record (usually 1024 bytes)
Where the data isFirst cluster in the entry, then the FAT chainExtent tree in the inodeResident in the record, or data runs
Names8.3 entry plus LFN entriesDirectory entries (name → inode)$FILE_NAME attribute and directory index
TimestampsLocal time, 2 s resolution, no time zoneUTC seconds (+ nanoseconds)UTC FILETIME, 100 ns, two sets ($SI and $FN)
On deletionFirst name byte → E5, FAT chain zeroedEntry merged into its predecessor, inode gets dtime, extents wipedRecord flag "in use" cleared, record stays until reused

5 Warm-up

Two quick checks before you start. Numbers can be typed in decimal or hex (0x…).

The start LBA of an MBR partition entry is a 4-byte little-endian number. On disk it reads 00 08 00 00. Which sector does the partition start at?

Little-endian: the first byte is the lowest. Reverse the bytes, then convert from hex.

Reversed: 00 00 08 00 = 0x00000800 = 8 × 256 = 2,048.

In bytes that is 2,048 × 512 = 1,048,576 = 0x100000 (1 MiB), the usual start of the first partition.

On which file system does deleting a file clear an "in use" flag and leave the file's metadata record in place, with name, times and data location, until it is reused?

See the row "On deletion" in the table above.

NTFS. The MFT record's flags at +0x16 go from 01 00 to 00 00; the attributes stay. FAT32 overwrites the first name byte with E5 and zeroes the FAT chain, and ext4 wipes the extents in the inode.