  Although keeping some basic concepts inherited from FAT32, the exFAT file
system introduces many differences, such as the new mapping scheme of directory
entries. The combination of exFAT mapping scheme with the allocation of bitmap
files and the use of FAT leads to new forensic possibilities. The recovery of
deleted files, including fragmented ones and carving becomes more accurate
compared with former forensic processes. Nowadays, the accurate and sound
forensic analysis is more than ever needed, as there is a high risk of
erroneous interpretation. Indeed, most of the related work in the literature on
exFAT structure and forensics, is mainly based on reverse engineering research,
and only few of them cover the forensic interpretation. In this paper, we
propose a new methodology using of exFAT file systems features to improve the
interpretation of inactive entries by using bitmap file analysis and recover
the file system metadata information for carved files. Experimental results
show how our approach improves the forensic interpretation accuracy.
