FAT32
| Format | FAT32 |
|---|---|
| Short name | FAT32 |
| Category | filesystem |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-12 |
Forensic relevance
The 32-bit File Allocation Table filesystem, used on USB sticks, SD cards, camera media, EFI system partitions and Android SD cards. Directory entries hold an 8.3 name (plus long-name entries), attributes, size, first cluster and creation/modification/access times in local time with 10 ms (creation), 2-second (modification) and day (access) resolution. A deleted entry keeps most of its fields with the first name byte set to 0xE5, but the cluster chain in the FAT is cleared, so recovery beyond the first cluster assumes the file was stored contiguously.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 82 (0x52) | 46 41 54 33 32 20 20 20 | FAT32 | Filesystem type string 'FAT32 ' in the boot sector |
| offset 82 (0x52) | 54 46 41 54 33 32 20 20 | TFAT32 | Filesystem type string 'TFAT32 ' in the boot sector (Windows CE transaction-safe FAT) |
Known extensions
None recorded
References
- File Allocation Table (FAT) format (libyal/libfsfat) https://github.com/libyal/libfsfat/blob/main/documentation/File%20Allocation%20Table%20(FAT)%20format.asciidoc
- ForensicsWiki — FAT https://forensics.wiki/fat/
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “FAT32”. https://kalink0.github.io/crush-forensics/formats/fat32/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction