File signature engraving and BPB key parameter verification-based research and implementation of an EXFAT digital forensics system

Addressing the issue of traditional digital forensics failing due to damaged metadata files and corrupted file header signature values in the EXFAT file system, this paper proposes an innovative forensics solution integrating file signature engraving and BPB key parameter verification. A five-module collaborative framework is constructed: scanning, computation, verification, engraving, and reconstruction. The scanning module identifies blocks and initializes metadata collection; The computation module quantifies integrity and establishes an evaluation framework; the verification module reconstructs BPB key parameters; the engraving module repairs incomplete items and blocks; the reconstruction module constructs a hierarchical directory tree. Experimental results demonstrate that under formatting and malicious damage scenarios, this scheme significantly improves forensic efficiency compared to other algorithms and mainstream software, providing an efficient solution for EXFAT file system digital forensics with important practical value.