The Fat File System - Part 1

Hi!In this tutorial I will tell you about the internal storing structure of the FAT file system. Mostly we will talk about the 12 bit FAT system but some insights to FAT 16 bit will also be given wherever relevant. In order to try this information through use of a program I will suggest that you do it on a floppy rather than screwing up your hard disk. This tutorial doesn’t give every detail on the FAT system but enough so that you can work yourself out the leftovers. So here we go.The Disk StructureThe diskettes are two sided and hard disks contain a number of two sided diskettes on a single spindle. The disks are managed by the controller that handles the operations on the disk surface.CylindersA cylinder is a vertical set of all tracks with same number on each surface of the disk. Thus cylinder 0 is the set of all tracks numbered 0 on either side of the disk. For example cylinder 0 consists of side 0, track0 and side 1, track 0.Similarly for other cylinders.SectorsSectors are the minimal amount of data that can be accessed. Several bytes make up a sector. For diskettes and hard drives its usually 512 bytes while it may differ for RAM drives. Every track is divided into these fragment units sectors .Sectors numbering starts from 1 unlike tracks which starts from 0.Physical SectorsPhysical sectors are numbered relative to a track. To access any location on the disk the side number, track number and sector uniquely identifies the data. The sector numbering is done relative to the track under consideration.Relative SectorRelative Sectors are numbered relative to the start of the disk. The disk starts at the outermost with cylinder 0, track 0. This sector is numbered as relative sector 0 the next sector 1 up to last sector on the disk.Any of the above two methods can be used by the system for accessing the data.ClusterCluster is a group of sectors. A cluster is always a power of two for example 1, 2, 4 or 8 sectors. For a 1.44MB floppy the cluster size is 1. That is 1 sector/cluster. This is usually done for accessing a bigger amount of data and avoiding too many read operations. However it also has a disadvantage as we shall soon see.The Disk System AreaThe disk system area for a preformatted disk starts from the start of the disk. That is cylinder 0, track 0, Sector 1.When the computer starts up the BIOS loads this area only. Since its just 1 sector (512 bytes) only the most important things are done in this part of the disk. This area of the disk contains 3 main partsa) BOOT RECORD also called MBR:o FAT (Both Entries)c) Directory Entry Now we take a look at what these things meanBoot RecordThe boot record contains information about what to do after the POST (Power on Self Test) operation and it also contain information about the general layout of the disk for example the number of clusters, sectors per cluster number of root directories entry etc. The whole thing looks like this on the sectorBoot Record FAT Directory entry System Files User Data---------------System Area--------------------- ------Data----The System files are copied to the data area at the time of formatting the diskette. In any case they are also treated the same as any other ordinary file and is kept in the same area as the user files, however since OS uses these files so they are kept at the very beginning and also with their attributes set to system files just to be safe from the user corrupting them.The Location of each of these entries is as shown below in the table Device Boot FAT Directory Sectors/Clusters3.5” 720 Kb 0 1-6 7-13 23.5” 1.44MB 0 1-19 19-32 1The above table shows the position of the sectors (relative). This shows that the boot sector is located in sector 0, the FAT is spread in next 18 sectors the Directory Entry in next 14 sectors for a 1.44MB diskette. Since 1 sector per cluster is allocated we can use the term cluster and sector interchangeably In this case however we are not going to so cluster is not equal to sector unless specified explicitly.The following table shows the contents of the first sector that is the boot sector Offset Description00h jump to bootstrap routine at 3E h03h Name / dos version number0Bh Bytes / sector usually 200h(512)0Dh sectors / cluster0Eh Number of reserved sectors10h Number of copies of FAT (1 or 2)11h Number of root directories13h Number of disk sectors if volume < 32MB15h Media descriptor byte same as first byte in Fat16h Number of sectors for FAT18h Number of sectors / track1Ah Number of R/W heads (sides)1Ch Number of hidden sectors1Eh Reserved by system20h Total number of sectors if volume > 32 MB24h Physical drive number (00h for A, for HDD C:=80h)25h Reserved By the System26h Extended Boot Sector Signature contains 29h27h Volume ID2Bh Volume Label36h Reserved by system3Eh-1FFh Bootstrap Loader begins HereThe Directory EntryAll files are stored on a cluster boundary. That means that although the smallest amount of accessible data is a sector, since the files are normally much bigger than 512 bytes therefore the OS uses clusters to hold files. This is just providing a larger space to a file and it is more efficient. The cluster is considered as an atomic unit that means that it is not possible to assign some amount of cluster to a file either a cluster is allocated or it is not. This also has a disadvantage in the form that if the file size is considerably smaller than the cluster size then the free space will be wasted. For each file that is created a 32 byte entry is created in the directory. The contents of the directory are shown belowOffset (hex) Description00-07 Filename. The first byte can also contain00h File is never used05h First Character of filename is E5h2Eh File is subdirectoryE5h File has been deleted08-0A File Extension0B File attribute00h normal file01h read only02h hidden04h system file08h volume label10h subdirectory20h archive file, wether file was rewritten Since last update.If for example: the attribute is 07h it means01h + 02h + 04h (read only +hidden +system)0C-15 Reserved by system16-17 Time of day when last modified / created Stored as hhhhh_mmmmmm_sssss i.e. 16 bits18-19 Date when the file was last modified / created Stored as yyyyyyy_mmmm_ddddd i.e. 16 bits1A-1B Starting cluster of file1C-1F Size of file in bytes. System calculates and writes size of file in this field.PS: For the fields whose data exceeds 1 byte, data is stored in reversed format i.e. Lower order byte followed by higher order byte.The File Allocation TableThe purpose of the FAT is to allocate disk space as a sequence of clusters. There is a FAT entry for each cluster on the disk. Its like linked list of pointers through which we can follow every byte in the file. There are 2 copies of FAT maintained in case one gets corrupted the other is used for accessing the files.The first entry in the FAT indicates the media type. This describes wether it’s a diskette or hard drive or some other disk type. The following describes the contents of 1st byte F0h 3.5” 2 sided 18sectors / track(1.44MB) or 36 sectors /track(2.88MB)F8h Hard DiskF9h 3.5” 2 sided 9sectors / track(720 kb)Second entry in FAT describes wether the FAT is 12 bit or 16 bitThe second entry contains FFFFh for 12 bit and FFFFFFh for 16 bit FAT. The FAT looks like this for above two12-BIT F0 FF FF 16-BIT F8 FF FF FF Working of the whole SystemThe FAT file system works in accordance with the directory entry and the File Allocation Table. The directory entry is used for both maintaining files and directories. The directory entry provides the entry point for a file since it has the field for starting cluster of the file. The rest of the clusters are obtained from the allocation table. The whole file allocation table is actually just pointer entries as to where to find the next cluster. The entries are relative to previous cluster. For example if we have a file that starts on cluster 2 and then continues on to 3rd cluster and finishes off at 4th cluster then the corresponding FAT entry at for cluster 2 will contain 3 , FAT entry for cluster 3 will contain 4. The EOF is marked with an FFF for a 12 bit FAT and FFFF for 16 bit FAT. Therefore entry 4-5 will have FFFF to mark EOF.Trick for Reading the FAT entriesA) If 12 bit FAT is being used multiply the current cluster number with 1.5. Access the FAT entry for this cluster number thus obtained also next to this one.C) Reverse the digits obtained from these two. Use first 3 digits if the cluster number that was multiplied was odd and last three if it was even.D) Repeat the process until you find the cluster with contents FFFh which will mark EOF.E) For 16 Bit FAT step C need not be done and EOF is marked with FFFFh.Total Files and Directories that can be made on 1.44MB disk with 12 bit FATNow since for each file allocated there is a directory entry of 32 bytes therefore total number of files / directories for the root directory can be calculated as followsSectors available for Directory Entry = 32-19+1= 14 Total Bytes available for Directory Entry = 14 * 512Total files / directories that can be made in root directory 512*14 / 32 = 224Now even if you make a file with nothing on it, after creating 224 files / directories you won’t be able to make any file or directories in the root directory.However you may still make some files in the subdirectory if there is enough space left on the FAT. Since a FAT is 18 sectors wide that means 18*512 bytes and we have a 12 bit entry for each cluster therefore maximum available FAT will be18*512/1.5 = 6Kb.So unless all these are filled up its possible to create files / directories in the subdirectory.PS: We did try this on Virtual PC. You can write a C/C++ program to write to floppy as many files/ directories as you can. Compare the results with above.

Nice tutorial, however, the FAT filesystem is no longer used for Windows, it's much better to use NTFS instead.xboxrulz

is it fat saver than ntfsbecause virus easily attack the hardisk with fat file systemis it true?

A wee correction... The FAT area on Fat12 may total 18 sectors, but this area contains both the FAT and the second copy of the FAT, so the FAT space is actually 9 sectors (not 18). Which gives 9 x 512B = 4608 Bytes available for FAT entries, divided by 1.5Bytes (12 bits) per entry = 3072 entries possible.

-reply by Chris Downs