Technical reference
Understanding exFAT: layout and deletion behaviour
The file system almost every camera card runs on — and why its layout decides your recovery chances.
The short answer
exFAT manages files through four structures.
Boot region, file allocation table, allocation bitmap and directory entries. Understanding which of these deletion changes and which it does not also explains why deleted recordings are usually still present, and why long video clips are the hardest case of all.
01 / Basis
Where exFAT appears, and why
exFAT stands for Extensible File Allocation Table and was designed for removable flash media. The SD Association mandates it for SDXC and microSDXC cards, meaning practically every card of 64 gigabytes and above. Cameras, drones, action cams and audio recorders therefore almost always write to exFAT.
Compared with the older FAT32, exFAT removes the four gigabyte per file limit. That is why it prevailed for video: a single 4K clip exceeds that limit easily.
Microsoft has published the specification officially. An implementation therefore does not have to rely on reverse engineering but can build on documented structures.
02 / Layout
The four structures at a glance
The last row is why data recovery works at all. The cluster heap is not touched during deletion. The recording still sits where it sat — the file system simply no longer knows about it.
| Structure | Purpose | On deletion |
|---|---|---|
| Boot region | Describes sector size, cluster size and where every other structure sits | Unchanged |
| Allocation bitmap | Records per cluster whether it is in use or free | Bit is set to free |
| File allocation table | Chains the clusters of fragmented files | Chain is released |
| Directory entries | Hold name, timestamps, size and first cluster | Marked as deleted |
| Cluster heap | Holds the actual file data | Physically preserved |
03 / Boot region
What the volume boot record contains
exFAT additionally places a complete backup of this boot region at sector 12. If the main region is damaged, the layout can be reconstructed from it. That redundancy is one reason an exFAT device often remains analysable even after its beginning has been damaged.
- The EXFAT identifier at offset 3, by which the file system can be recognised unambiguously.
- Sector size and cluster size, each stored as a power of two.
- Offset and length of the file allocation table, plus the number of FATs.
- The start of the cluster heap and the total cluster count.
- The first cluster of the root directory as the entry point into the folder structure.
- The boot signature 0x55AA at the end of the sector.
04 / Deletion
What deletion actually does
For reconstruction that means: for a contiguously stored file, the first cluster and size from the directory entry are enough to read it completely. For a fragmented file the chain is missing, because it was released in the FAT. That is precisely why long, fragmented video clips are the hardest case.
- 1
The directory entry is marked as no longer in use. Name, size, timestamps and first cluster initially remain readable.
- 2
In the allocation bitmap the corresponding clusters are marked as free.
- 3
If the file was fragmented, its chain in the FAT is released.
- 4
The content in the cluster heap stays untouched until something new is written to the same place.
Flash storage maps logical addresses freely onto physical cells internally. On media that support TRIM and whose controller actively erases released areas, data can be physically gone shortly after deletion. On classic SD cards in cameras this is rarer than on internal SSDs, but not impossible.
05 / Practice
What follows for recovery
- Stop writing immediately. The cluster heap is the only source; every new recording can partly overwrite it.
- Do not run a file-system repair. CHKDSK and similar tools write into exactly the structures reconstruction needs.
- Create an uncompressed image. You can then analyse as often as you like with any tool without stressing the device again.
- Verify results against the format structure, not just the file header. With fragmented files that is where completeness is actually decided.
Sources and technical references
Common questions
How do I tell whether my card is exFAT?
SDXC and microSDXC cards of 64 gigabytes and above ship as exFAT. On Windows the drive properties show it, on macOS Disk Utility does. For an image you can check it with the boot sector tool on this site.
Why are videos harder to recover than photos?
A photo is small and usually stored contiguously. A long video clip is many times larger and frequently fragmented. Because the chain of fragmented files is released in the FAT on deletion, it has to be reconstructed — and that is the hardest part.
Does the backup boot region help with damaged cards?
It helps when the main boot region is damaged but the remaining structures are intact. It does not replace reconstruction of directory entries, and it does not repair a physically defective device.
Is exFAT safer or less safe than other file systems?
exFAT is deliberately lean and has no journal. A journal can help restore the last consistent state after a power failure. Without one, an interrupted recording is somewhat more critical on exFAT.
Theory clear, practice next?
Read your image's boot sector straight in the browser.