Usb Xtaf Gui Version 31 16
Melanie Wendelberger
A completely original program developed by slasherking823, XTAF Explorer can view, extract and inject files from a usb memory card that has been formatted by the xbox 360. It allows not only safe backup of game files, but also provides the ability to access your 360 data files for modding purposes. It has a built in GruntMods auto-updater to make sure you have the latest version on hand. It is available free to use in any guide or tutorial as well as home use, provided credit is given to the author and GruntMods. Forget buying a data migration kit from Microsoft, or Xport from Datel, XTAF Explorer is all you need to:
Note: Upon future investigation, it looks like the last update for the Xbox 360 changed the way external drives work significantly, the files are now stored directly on the USB and can be edited by an editing program without the need for a transfer tool like USB XTAF explorer. As such, there will not be any future updates to USB XTAF Explorer since new systems can no longer use it at all. The download page and server will still be maintained for legacy USB backups that need to be modified.
FATX is the file system used by the Xbox and the Xbox 360, it is unsupported natively by Windows but has some functionality in Linux. Sometimes called "XTAF" (due to its little endian header), the file system is derived from the age-old MS-DOS file system and can be considered as a cleaned-up version of it.
Note that, while not part of the file system itself, the media which contain this file system do not have a master file table which describes which file system starts where. It is up to the consumer (Xbox 360, geom_xbox360 kernel module, ...) to know this.
The essential difference between retail and devkit HDDs is that devkit HDDs hold a partition table (length of 0x18 bytes) at the start of the drive. The table contains sector and length information for the Content and DEVKIT Partitions (possibly Compatibility partition too). This partition table only exists on Devkit HDDs, retails have the offsets built in to the kernel.
Unlike the hard disks and memory units that the Xbox 360 originally shipped with, the USB drives which can be Xbox 360-configured contain sets of files located in a hidden "Xbox360" folder located in the root of the device. The Data0000-Data0003 files are always present no matter what the device size. The Data0000 file houses the Cache/USB System Extended partitions, device performance information, and device geometry (mainly just the total device size). Data0001 contains the file allocation table for the Data partition, which uses the remaining files.
There was some research done in hopes to remove the maximum device size of 16 GB (for Xbox 360 storage) on exploited/development consoles, but it was later discovered that anything a few GB larger than the current maximum causes the console to crash. =16913.0
The configuration is the first 2 sectors (0x400 bytes) of the Data0000 and is created when the device is configured. It contains info about the device and is secured with a signature. The layout is as follows:
The signature is derived from a SHA1 hash taken from the start of the device id (0x228) till the end of the config (0x1D8 bytes) and is signed with the consoles private key and the matching public parameters are present in the console certificate for verification later on.
The certificate size is used to determine how to verify the configuration file when the device is mounted. If the value is 0x228 then the device was configured by an Xbox and the signature is verified using the params in the console certificate, if the value is 0x100 then the device was pre-configured by Microsoft and is verified using the SATA public key (also used for HDDSS verification).
The last 2 values are written when the device is configured, it is unknown how these are used later on. Perhaps it could be used to determine what connected device would provide best performance for caching.
The SystemUpdate with Kernel-Version 2.0.12611.0 (Kinect-Dashboard) introduced a new system to hold the Kinect-/Avatar related systemfiles. It creates a Partition named "SysExt" aka SystemExtended to store these files. You could call it a Sub-Partition or Hidden-Partition as it's a "Partition inside another Partition".
The Security Sector is used by Microsoft to verify that the harddrive is an original Microsoft product. The Security Sector holds details such as drive sector count, drive serial number and the Microsoft logo (to stop other companies using it)
To find the offset of the chainmap, take the offset of the position and add 4096 (0x1000) to it. Each entry in the chainmap is either an unsigned int or a unsigned short, depending on the number of clusters inside the partition.
If the number of clusters is below 65520 (0xFFF0), then the drive uses 2-byte chainmap entries, otherwise it uses 4-byte chainmap entries. The size of the chainmap is the size of the chainmap entries multiplied by the partitions cluster count.
To get a clusters offset, you need to work out the offset of the file data area. This is determined by taking the chainmap offset and adding it's size to it. You then simply times the cluster index (minus 1) by the cluster size and add it to the file data offset.
The file contents is stored per cluster as indicated by the chainmap and the starting cluster (see below). If the file is larger than one cluster, it is stored in multiple clusters. If the length of the file is not a multiple of the cluster size, then the last cluster is only partially used. If the file covers more than 1 cluster, the next cluster must be determined by finding the current cluster's entry in the chainmap and using the value as the next cluster.
Directories are stored in a tabular format. Because directories are normal files with the "directory" bit set, they are allocated in the FAT and may therefore cover multiple clusters. This makes it possible to have many files in one directory.
The file flags and the date and time fields are in the same format as the one used in the FAT file system. For time, bits 15-11 represent the hour, 10-5 the minutes, 4-0 the seconds. For date, bits 15-9 are the year, 8-5 are the month, 4-0 are the day.
b37509886e