An Exploration of CFB 5

An Exploration of CFB 5

CFB Mini FAT

The Mini FAT is used to allocate much smaller units of information into equal-length sectors of 64-bytes. The first mini FAT sector is mapped by the FAT and then the rest are found by following the chain. The offset of any mini FAT sector can be calculated by a mere simple formula: sector number x 64. Since the size of the mini FAT sectors depends on the size of the FAT Sectors, the amount of mini fat sector fields per sector relies heavily on the version of the file. Version 3 results in 128 fields while version 4 contains 1024 fields.

if majver == 3:

                for i in range( 0, 127 ):

                f.read ( 4 )

if majver == 4:

                for i in range ( 0, 1023 ):

                                f.read ( 4 )

 

The mini FAT sector is used to find the relevant mini streams. These streams are found as subunits underneath the stream sectors. The streams themselves are also 64 bytes long. They are chained exactly the same way in the FAT as a normal stream. Reading this data can be done in the following:

f.seek ( MINISTREAMSECLOC )

f.read ( 64 )

 

There is no real way to parse the information found in the stream without the given context. This is because the Mini Stream contains user-defined data that can take on any particular form. Thus, without knowing what is in the stream, we can simply read the data block-by-block if we are merely making a general parser.