Forensics - ExFat Bastardized for Cameras presented at Shmoocon 2013

by Scott Moulton,

Tags: Security

Summary : In forensics there is a new file system called ExFat. Microsoft has made a deal with the SD Card Association to make ExFat the standard for all SD cards over 32gigs. Microsoft has protected this property and is doing everything it can to collect licensing fees for ExFat for any device wanting to use the SD Associations standard. Many people do not know are happening and the changes in cameras, which will eventually affect every single new device from laptops, OSs, to tablets and phones.
We have all been blindsided and Microsoft now owns the market for SD larger than 32gigs and will BE PAID for every new device including Linux based due to this change in storage media. In turn this affects forensics, and adds additional costs to forensic equipment and software. I will break down this new format and show how this cost is implemented and educate people about SDXC, where it will be used.

Scott Moulton: Scott Moulton loves Shmoocon and wants you guys to be the first ones to see this new process. Currently Scott Moulton runs a data recovery company called as well as classes teaching his techniques to both the public and private sectors. Scott focuses his efforts on dispelling the myths of data recovery by showing how you can rebuild your own hard drives, perform data recovery for yourself or as business. Scott was the first person arrested for Port Scanning in January of 2000 and during his defense, Scott found he had to train his lawyers on the technical aspects to win his case. This began his forensic career with a specialty in rebuilding HARD DRIVES for investigation purposes by extraction of corrupt data from damage hard drives, solid state drives or other media.