FAT: Difference between revisions

{{Filesystems}}

 

== Overview ==

 

=== FAT 32 ===

 

=== ExFAT ===

{{Main|ExFAT}}

 

=== VFAT ===

{| {{wikitable}}

|-

! Size (in bytes)

! Meaning

|-

| 3

| The first three bytes EB 3C 90 disassemble to JMP SHORT 3C NOP. (The 3C value may be different.) The reason for this is to jump over the disk format information (the BPB and EBPB). Since the first sector of the disk is loaded into ram at location 0x0000:0x7c00 and executed, without this jump, the processor would attempt to execute data that isn't code. Even for non-bootable volumes, code matching this pattern (or using the E9 jump opcode) is required to be present by both Windows and OS X. To fulfil this requirement, an infinite loop can be placed here with the bytes EB FE 90.

|-

| 3

| 8

|-

| 11

| 2

| The number of Bytes per sector (remember, all numbers are in the little-endian format).

|-

| 1

| Number of sectors per cluster.

|-

| 14

| 2

| Number of reserved sectors. The boot record sectors are included in this value.

|-

| 1

| Number of File Allocation Tables (FAT's) on the storage media. Often this value is 2.

|-

| 17

| 2

|-

| 19

| 2

|-

| 1

|-

| 2

| Number of sectors per FAT. FAT12/FAT16 only.

|-

| 2

| Number of sectors per track.

|-

| 2

| Number of heads or sides on the storage media.

|-

| 4

| Number of hidden sectors. (i.e. the LBA of the beginning of the partition.)

|-

| 32

| 4

|}

 

 

==== Extended Boot Record ====

 

===== FAT 12 and FAT 16 =====

{| {{wikitable}}

|-

! Length (in bytes)

! Meaning

|-

| 1

|-

| 1

| Flags in Windows NT. Reserved otherwise.

|-

| 1

|-

| 4

|-

| 43

| 11

|-

| 54

| 8

|-

| 62

| 448

|-

| 510

| 2

|}

 

{| {{wikitable}}

|-

! Length (in bytes)

! Meaning

|-

| 4

|-

| 2

| Flags.

|-

| 42

| 2

|-

| 44

| 4

|-

| 48

| 2

|-

| 50

| 2

|-

| 52

| 12

|-

| 1

|-

| 1

|-

| 1

|-

| 4

|-

| 71

| 11

|-

| 82

| 8

|-

| 90

| 420

|-

| 510

| 2

|}

 

=== File Allocation Table ===

==== FAT 12 ====

FAT 12 uses 12 bits to address the clusters on the disk. Each 12 bit entry in the FAT points to the next cluster of a file on the disk. Given a valid cluster number, here is how you extract the value of the next cluster in the cluster chain:

unsigned int fat_offset = active_cluster + (active_cluster / 2);// multiply by 1.5

 

 

unsigned short table_value = *(unsigned short*)&FAT_table[ent_offset];

 

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

If "table_value" is greater than or equal to (>=) 0xFF8 then there are no more clusters in the chain. This means that the whole file has been read. If "table_value" equals (==) 0xFF7 then this cluster has been marked as "bad". "Bad" clusters are prone to errors and should be avoided. If "table_value" is not one of the above cases then it is the cluster number of the next cluster in the file.

 

 

==== FAT 16 ====

FAT 16 uses 16 bits to address the clusters on the disk. Because of this, it is much easier to extract the values out of a 16 bit File Allocation Table. Here is how it is done:

unsigned char FAT_table[sector_size];

unsigned int fat_offset = active_cluster * 2;

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

If "table_value" is greater than or equal to (>=) 0xFFF8 then there are no more clusters in the chain. This means that the whole file has been read. If "table_value" equals (==) 0xFFF7 then this cluster has been marked as "bad". "Bad" clusters are prone to errors and should be avoided. If "table_value" is not one of the above cases then it is the cluster number of the next cluster in the file.

 

unsigned char FAT_table[sector_size];

unsigned int fat_offset = active_cluster * 4;

 

//remember to ignore the high 4 bits.

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

 

A directory entry simply stores the information needed to know where a file's data or a folder's children are stored on the disk. It also holds information such as the entry's name, size, and creation time. There are two types of directories in a FAT file system. Standard 8.3 directory entries, which appear on all FAT file systems, and Long File Name directory entries which are optionally present to allow for longer file names.

 

| 13

| 1

|-

| 14

Notice that each character is two bytes long and that the name is null terminated. The two FF's at the end are the padding at the end of the long file name. This is also what the other FF's in the long file name entry are.

The final important thing to notice about the long file name entry is it's attribute byte at offset 11. the 0x0F attribute allows us to verify that this is indeed a long file name entry.

 

== Programming Guide ==

This section is intended to give you information about common functions that are preformed on a FAT file system.

 

=== Reading the Boot Sector ===

 

Here is an example of some boot sector structures in C.

typedef struct fat_extBS_32

{

}__attribute__((packed)) fat_BS_t;

Important pieces of information that can be extracted from the boot sector include:

 

'''Total sectors in volume (including VBR):'''

total_sectors = (fat_boot->total_sectors_16 == 0)? fat_boot->total_sectors_32 : fat_boot->total_sectors_16;

 

'''FAT size in sectors:'''

fat_size = (fat_boot->table_size_16 == 0)? fat_boot_ext_32->table_size_16 : fat_boot->table_size_16;

 

'''The size of the root directory (unless you have FAT32, in which case the size will be 0):'''

root_dir_sectors = ((fat_boot->root_entry_count * 32) + (fat_boot->bytes_per_sector - 1)) / fat_boot->bytes_per_sector;

This calculation will round up. 32 is the size of a FAT directory in bytes.

 

 

'''The first data sector (that is, the first sector in which directories and files may be stored):'''

first_data_sector = fat_boot->reserved_sector_count + (fat_boot->table_count * fat_size) + root_dir_sectors;

 

 

'''The first sector in the File Allocation Table:'''

first_fat_sector = fat_boot->reserved_sector_count;

 

 

'''The total number of data sectors:'''

 

 

'''The total number of clusters:'''

total_clusters = data_sectors / fat_boot->sectors_per_cluster;

This rounds down.

 

'''The FAT type of this file system:'''

{

fat_type = FAT12;

fat_type = FAT16;

}

{

fat_type = FAT32;

}

 

=== Reading Directories ===

The first step in reading directories is finding and reading the root directory. On a FAT 12 or FAT 16 volumes the root directory is at a fixed position immediately after the File Allocation Tables:

first_root_dir_sector = first_data_sector - root_dir_sectors;

 

root_cluster_32 = extBS_32->root_cluster;

 

For each given cluster number we can calculate the first sector of it (relative to the partition's offset):

first_sector_of_cluster = ((cluster - 2) * fat_boot->sectors_per_cluster) + first_data_sector;

 

After the correct cluster has been loaded into memory, the next step is to read and parse all of the entries in it. Each entry is 32 bytes long. For each 32 byte entry this is the flow of execution:

# Read the cluster represented by the extracted value and return for more directory parsing.

# The end of the cluster chain has been found. Our work here is finished. :)

 

== Creating a fresh FAT filesystem ==