Question

Describe one or two key differences between FAT and NTFS. From the perspective of a forensic examiner, what are some of the pros and cons of each?

Answer 1

`Hey,

Note: Brother if you have any queries related the answer please do comment. I would be very happy to resolve all your queries.

• The FAT is simple while the NTFS structure is quite complicated.
• NTFS can support larger file and volume sizes along with large file names relative to the FAT file system.
• FAT does not provide encryption and much security whereas NTFS is enabled with security and encryption.

NTFS stands for New Technology File System and is Microsoft’s file system of choice in all of its operating systems since Windows NT 3.1 in 1993. Before this there was File Allocation Table or FAT (the 32 on the end came about later for 32-bit versions of Windows). NTFS is the more modern file system and the one that you’ll probably find yourself using the majority of the time (even if you don’t realise it). However, there are occasions when it may be necessary to use FAT32. But what are the differences between these two file systems?
If you want to host Active Directory (which provides a centre for network administration and security) and have domain-based security then you’ll only be able to do this with NTFS. It also provides much more security as folder and file access can be individually controlled. File permissions can be set to help protect your data from any malware that could try and bury itself within. FAT32 has little security and is not supported by Active Directory, although there are other methods available to restrict data access.
FAT32 supports partitions up to 2 terabytes in size, although Windows 2000 only supports FAT32 partitions up to 32 GB. The downside to this is that there is a 4 GB file size limitation with FAT32. Volumes much larger than 2 TB are possible when running NTFS and are limited only by the size of the volume. The only downside is that NTFS cannot be used on floppy disks, but this is an archaic format by today’s standards. Also, NTFS is much more space efficient. The file system allows for file compression and lets you control how much disk space each user is able to use. NTFS uses small cluster sizes and as a result wastes less disk space than FAT32 does. If you are using a disk that has a lot of space (and most consumers are since larger drives are becoming more common and cheaper) then NTFS is the file system that works best.

Kindly revert for any queries

Thanks.