exFAT
| Format | exFAT |
|---|---|
| Short name | exFAT |
| Category | filesystem |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Microsoft's Extended FAT for flash media: SDXC cards, large USB drives and cameras. Files are described by entry sets (file, stream extension and file name entries) with timestamps that carry 10 ms resolution and a UTC offset. Contiguous files may have no FAT chain at all. A deleted entry set keeps its data with the in-use bit cleared.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 3 (0x3) | 45 58 46 41 54 20 20 20 | EXFAT | Filesystem name 'EXFAT ' in the boot sector |
Known extensions
None recorded
References
- exFAT File System Specification (Microsoft) https://learn.microsoft.com/en-us/windows/win32/fileio/exfat-specification
- File Allocation Table (FAT) format, incl. exFAT (libyal/libfsfat) https://github.com/libyal/libfsfat/blob/main/documentation/File%20Allocation%20Table%20(FAT)%20format.asciidoc
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “exFAT”. https://kalink0.github.io/crush-forensics/formats/exfat/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction