FAT: Difference between revisions

{{Filesystems}}

 

== Overview ==

To read the filesystem, find out how big a 'sector' and a 'cluster' are. A sector is (1 << sectorshift) bytes, a cluster is (1 << (sectorshift + clustershift)) bytes. Then, find the start of the FAT and the start of the cluster heap (note that the first cluster is *still* cluster 2).

 

// This allows you to zero-index clusters:

uint64_t clusterArray = clusterheapoffset * sectorsize - 2 * clustersize;

uint64_t fatOffset = fatoffset * sectorsize;

uint64_t usablespace = clustercount * clustersize;

 

Note that all values in the BPB are now naturally aligned and that this code is *significantly* simpler than FAT32's BPB reading.

==== FAT 12 ====

FAT 12 uses 12 bits to address the clusters on the disk. Each 12 bit entry in the FAT points to the next cluster of a file on the disk. Given a valid cluster number, here is how you extract the value of the next cluster in the cluster chain:

unsigned char FAT_table[sector_size * 2]; // needs two in case we straddle a sector

unsigned int fat_offset = active_cluster + (active_cluster / 2);// multiply by 1.5

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

If "table_value" is greater than or equal to (>=) 0xFF8 then there are no more clusters in the chain. This means that the whole file has been read. If "table_value" equals (==) 0xFF7 then this cluster has been marked as "bad". "Bad" clusters are prone to errors and should be avoided. If "table_value" is not one of the above cases then it is the cluster number of the next cluster in the file.

 

==== FAT 16 ====

FAT 16 uses 16 bits to address the clusters on the disk. Because of this, it is much easier to extract the values out of a 16 bit File Allocation Table. Here is how it is done:

unsigned char FAT_table[sector_size];

unsigned int fat_offset = active_cluster * 2;

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

If "table_value" is greater than or equal to (>=) 0xFFF8 then there are no more clusters in the chain. This means that the whole file has been read. If "table_value" equals (==) 0xFFF7 then this cluster has been marked as "bad". "Bad" clusters are prone to errors and should be avoided. If "table_value" is not one of the above cases then it is the cluster number of the next cluster in the file.

 

==== FAT 32 and exFAT ====

FAT 32 uses 28 bits to address the clusters on the disk. The highest 4 bits are reserved. This means that they should be ignored when read and unchanged when written. exFAT uses the full 32 bit to encode sector numbers. Similar to the same operation on a 16 bit FAT:

unsigned char FAT_table[sector_size];

unsigned int fat_offset = active_cluster * 4;

 

//the variable "table_value" now has the information you need about the next cluster in the chain.

If "table_value" is greater than or equal to (>=) 0x0FFFFFF8 (or 0xFFFFFFF8 for exFAT) then there are no more clusters in the chain. This means that the whole file has been read. If "table_value" equals (==) 0x0FFFFFF7 (or 0xFFFFFFF7 for exFAT) then this cluster has been marked as "bad". "Bad" clusters are prone to errors and should be avoided. If "table_value" is not one of the above cases then it is the cluster number of the next cluster in the file.

 

| 13

| 1

|-

| 14

| 20

| 1

|-

| 21

| 1

|-

| 22

 

Here is an example of some boot sector structures in C.

typedef struct fat_extBS_32

{

}__attribute__((packed)) fat_BS_t;

Important pieces of information that can be extracted from the boot sector include:

 

'''Total sectors in volume (including VBR):'''

total_sectors = (fat_boot->total_sectors_16 == 0)? fat_boot->total_sectors_32 : fat_boot->total_sectors_16;

 

'''FAT size in sectors:'''

fat_size = (fat_boot->table_size_16 == 0)? fat_boot_ext_32->table_size_16 : fat_boot->table_size_16;

 

'''The size of the root directory (unless you have FAT32, in which case the size will be 0):'''

root_dir_sectors = ((fat_boot->root_entry_count * 32) + (fat_boot->bytes_per_sector - 1)) / fat_boot->bytes_per_sector;

This calculation will round up. 32 is the size of a FAT directory in bytes.

 

 

'''The first data sector (that is, the first sector in which directories and files may be stored):'''

first_data_sector = fat_boot->reserved_sector_count + (fat_boot->table_count * fat_size) + root_dir_sectors;

 

 

'''The first sector in the File Allocation Table:'''

first_fat_sector = fat_boot->reserved_sector_count;

 

 

'''The total number of data sectors:'''

 

 

'''The total number of clusters:'''

total_clusters = data_sectors / fat_boot->sectors_per_cluster;

This rounds down.

 

'''The FAT type of this file system:'''

if (sectorsize == 0)

{

fat_type = FAT32;

}

 

=== Reading Directories ===

The first step in reading directories is finding and reading the root directory. On a FAT 12 or FAT 16 volumes the root directory is at a fixed position immediately after the File Allocation Tables:

first_root_dir_sector = first_data_sector - root_dir_sectors;

 

In FAT32 and exFAT, root directory appears in data area on given cluster and can be a cluster chain. In exFAT it cannot be encoded as extent and will always be present in the FAT.

root_cluster_32 = extBS_32->root_cluster;

 

For each given cluster number we can calculate the first sector of it (relative to the partition's offset):

first_sector_of_cluster = ((cluster - 2) * fat_boot->sectors_per_cluster) + first_data_sector;

 

After the correct cluster has been loaded into memory, the next step is to read and parse all of the entries in it. Each entry is 32 bytes long. For each 32 byte entry this is the flow of execution: