<p>FAT (File Allocation Table) file system is the most popular file system in consumer electronic devices. However, due to lack of provenance maintenance of file system operations, FAT file systems are not able to provide credible and admissible evidence of the origin, modification, and access history of files during a digital forensic investigation. In this paper, we propose a stackable file system (namely <i>forFAT</i>) that enhances the forensic capability of FAT file systems to maintain the provenance of file system operations. <i>forFAT</i> uses v-node stacking for operation interception and records provenance information of operations in volume. We discuss the design and implementation of <i>forFAT</i> and experimentally evaluate it for its forensic capability and performance overhead using synthetic workload on various storage devices. The results of our experiments suggest that <i>forFAT</i> maintains detailed provenance information about file system operations that can be used in digital forensic investigations to reconstruct the timeline of operations performed on the file system. Furthermore, the results suggest that the proposed file system adds minimal performance overhead of an average of 4.75% for read operation and 6.03% for truncate operation with a performance gain of 18.32% for append operation and 1.17% for seek operation on solid-state drives.</p>