Relationship between the directory entry structures, clusters, and FAT structure:
Course list: http://www.c-jump.com/bcc/
Simple - and common - file system
Found on all Windows OS and many devices
FAT12: Developed 1977 (MS Disk BASIC)
FAT16: Developed 1987 (MS-DOS 3.31)
FAT32: Developed 1996 (Win95 OSR2)
Few data structures supported:
Cluster: Basic storage unit for files
Directory: Lists file name, starting cluster, and length
File Allocation Table: Contains cluster status and pointer to next cluster in chain
Relationship between the directory entry structures, clusters, and FAT structure:
|
|
A cluster is a group of consecutive sectors
A sector is usually 512 B
A cluster is 1, 2, 4, 8, 16, 32, or 64 sectors (i.e., it can range from 512 B to 32 KB)
Each cluster has an address
The first cluster has an address of 2
I.e., there is no addressable cluster 0 or 1
|
|
|
|
First sector of a FAT system is the boot sector
Contains most of the information with which to determine
the file system type, and
size and location of data structures
Boot sector format is different for FAT12/16 and FAT32
| Bytes | Purpose |
|---|---|
| 0-2 | Assembly code instructions to jump to boot code (mandatory in bootable partition) |
| 3-10 | OEM name in ASCII |
| 11-12 | Bytes per sector (512, 1024, 2048, or 4096) |
| 13 | Sectors per cluster (Must be a power of 2 and cluster size must be <=32 KB) |
| 14-15 | Size of reserved area, in sectors |
| 16 | Number of FATs (usually 2) |
| 17-18 | Maximum number of files in the root directory (FAT12/16; 0 for FAT32) |
| 19-20 | Number of sectors in the file system; if 2 B is not large enough, set to 0 and use 4 B value in bytes 32-35 below |
| 21 | Media type (0xf0=removable disk, 0xf8=fixed disk) |
| 22-23 | Size of each FAT, in sectors, for FAT12/16; 0 for FAT32 |
| 24-25 | Sectors per track in storage device |
| 26-27 | Number of heads in storage device |
| 28-31 | Number of sectors before the start partition |
| 32-35 | Number of sectors in the file system; this field will be 0 if the 2B field above (bytes 19-20) is non-zero |
| Bytes | Purpose |
|---|---|
| 0-35 | (See previous table) |
| 36 | BIOS INT 13h (low level disk services) drive number |
| 37 | Not used |
| 38 | Extended boot signature to validate next three fields (0x29) |
| 39-42 | Volume serial number |
| 43-53 | Volume label, in ASCII |
| 54-61 | File system type level, in ASCII. (Generally "FAT", "FAT12", or "FAT16") |
| 62-509 | Not used |
| 510-511 | Signature value (0xaa55) |
00-02: eb 3c 90 Instructions to jump to boot code
03-0a: 4d 53 44 4f 53 35 2e 30
Name string (MSDOS5.0)
0b-0c: 00 02 Bytes/sector (0x0200 = 512)
0d : 01 Sectors/cluster (1)
0e-0f: 01 00 Size of reserved area (1 sector)
10 : 02 Number of FATs (2)
11-12: e0 00 Max. number of root directory entries (0x00e0 = 224)
13-14: 40 0b Total number of sectors (0x0b40 = 2,880)
15 : f0 Media type (removable)
16-17: 09 00 FAT size (0x0009 = 9 sectors)
18-19: 12 00 Sectors/track (0x0012 = 18)
1a-1b: 02 00 Number of heads (0x0002 = 2)
1c-1f: 00 00 00 00 Number of sector before partition (0)
20-23: 00 00 00 00 Total number of sectors (0 because 2B value not equal 0)
24 : 00 Drive number (0)
25 : 00 Unused
26 : 29 Extended boot signature
27-2a: cf cd b1 c4 Volume serial number (C4B1-CDCF)
2b-35: 4e 4f 20 4e 41 4d 45 20 20 20 20
Volume label ("NO NAME ")
36-3d: 46 41 54 31 32 20 20 20
File system type label ("FAT12 ")
3e-1fd : [snip] Not used
1fe-1ff: 55 aa Signature value (0xaa55)
FAT12 allocates 12 bits per FAT entry
Limits addressing to 4,096 (212) clusters
This (removable) device is configured so that:
1 cluster = 1 sector
1 sector = 512 B
This FAT12 table is limited in capacity to 2,097,152 bytes (2 MB)
I.e., 4K clusters of 512 B each
This device has 2,880 sectors
512 B clusters yields a device capacity of 1.44 MB
Corresponds to what we would expect for a floppy
| Sector(s) | Address | Function |
|---|---|---|
| 0 | 0x0000-0x01ff | Boot Sector |
| 1-9 | 0x0200-0x13ff | File Allocation Table (primary) |
| 10-18 | 0x1400-0x25ff | File Allocation Table (secondary) |
| 19-32 | 0x2600-0x41ff | Root Directory |
| 33-2879 | 0x4200-0x167fff | File storage space |
NOTES:
Boot Sector is 1 sector (0x200 bytes)
There are two FATs, each 9 sectors (0x1200 bytes)
The Root Directory can contain 224 entries, each 32 bytes (7168, or 0x1c00, bytes; 14 sectors)
File storage starts at sector #33 (1+9+9+14), byte #0x4200 (0x200+0x1200+0x1200+0x1c00)
Contains file names and metadata
Located immediately after FAT(s) in FAT12/16 or in a location specified in the FAT32 boot sector
Supports 8.3 names or long file names
New entries are added to the directory using a first-available or next-available strategy
First-available: Finds first unallocated entry in the directory (e.g., Win98)
Next-available: Finds next available entry from the last allocated entry; at end of directory chain, start again at beginning (e.g., WinXP)
The Root Directory is a series of entries describing files
Each entry is 32 bytes and contains
single short (8.3) filename (SFN),
attributes,
MAC times,
start cluster,
size,
and other metadata.
Additional 32B entries contain the file's long filename (LFN)
Three files shown here:
BELIN_~1.JPG @ offset 0xff160 (belin_gayle.jpg entry starts @ offset 0xff140)
KESSLE~1.JPG @ offset 0xff1c0 (kessler_gary.jpg entry starts @ offset 0xff1a0)
?HUMBS.DB @ offset 0xff200 (Thumbs.db; deleted)
|
|
The Primary FAT starts at Sector 1, byte #0x0200.
Suppose a file has a starting cluster of 0x49 (73).
The file starts on the media at cluster #73
The FAT entry pointing to the next cluster is in the FAT at byte #(73*1.5 + 1) = 110 (0x6e)
Since the FAT starts at 0x0200, the FAT entry for this file is at 0x026e
Example:
1st cluster is 0x49 (73). FAT entry starts at high-order nibble of 0x026e (110) = 0x04a (74)
2nd cluster is 0x4a (74). FAT entry starts at low-order nibble of 0x0270 (112) = 0x04b (75)
3rd cluster is 0x04b (75). FAT entry starts at high-order nibble of 0x0271 (113) = 0x04c (76)
4th cluster is 0x04c (76). FAT entry starts at low-order nibble of 0x0273 (115) = 0x04d (77)
5th cluster is 0x04d (77). FAT entry starts at high-order nibble of 0x0274 (116) = 0xfff (end of list)
The physical size of this file is five clusters (2560 bytes), and occupies clusters 73, 74, 75, 76, and 77 on the medium. (It is merely a coincidence that the clusters are contiguous.)
Formatting will initialize the FATs (0x00) and root directory (0xF6)
On a floppy, format will overwrite the data area with 0xF6
Data is NOT deleted when using Quick Format on a floppy or any format on a hard drive
|
|
Find first free entry in directory and write file name
Search FAT for unallocated cluster; set to EOF (0xFFF)
Write that cluster's address into directory entry
If another cluster is needed,
find an unallocated FAT entry,
reset that value to EOF, and
reset previous FAT pointer to this new cluster
(Repeat this step as necessary.)
Find directory entry for file to delete
Using starting cluster value in the root directory, set all FAT entries in file's cluster chain to zero
Deallocate directory entry by overwriting first byte of the entry with 0xE5 (å)
FAT: General Overview of On-Disk Format, v1.03 (12/6/2000), Microsoft:
File Allocation Table, Wikipedia:
