FAT
File Allocation Table
FAT (Dateizuordnungstabelle)
FAT is a simple, very widespread file system that records via an allocation table which storage areas belong to which file. Because of its simplicity and broad compatibility it is found to this day on USB sticks, memory cards and in embedded devices. Forensically it is well understood and productive.
History & facts. FAT (in variants such as FAT32 and the more modern exFAT) is one of the oldest and simplest file systems. When a file is deleted, usually only the table entry is marked as free, while the actual data persists — which often facilitates the reconstruction of deleted content. Because of its prevalence on removable media, FAT is frequently encountered in investigations.
Outlook & recommendation. For forensics, FAT is rewarding: its structure is well documented, and deleted entries as well as residual data can often be recovered. On USB sticks and memory cards — typical carriers for data outflow — it is the standard format. As with every data carrier: create a bit-precise image with a hash, work on the copy, include deleted areas and slack space. On more modern systems, NTFS (with its Master File Table) takes the place of FAT.