The Fat File System - Part 1
Discussion by Aditya with 3 Replies.
Last Update: September 8, 2010, 10:26 pm
In this tutorial I will tell you about the internal storing structure of the FAT file system. Mostly we will talk about the 12 bit FAT system but some insights to FAT 16 bit will also be given wherever relevant. In order to try this information through use of a program I will suggest that you do it on a floppy rather than screwing up your hard disk. This tutorial doesn’t give every detail on the FAT system but enough so that you can work yourself out the leftovers. So here we go.
The Disk Structure
The diskettes are two sided and hard disks contain a number of two sided diskettes on a single spindle. The disks are managed by the controller that handles the operations on the disk surface.
A cylinder is a vertical set of all tracks with same number on each surface of the disk. Thus cylinder 0 is the set of all tracks numbered 0 on either side of the disk. For example cylinder 0 consists of side 0, track0 and side 1, track 0.Similarly for other cylinders.
Sectors are the minimal amount of data that can be accessed. Several bytes make up a sector. For diskettes and hard drives its usually 512 bytes while it may differ for RAM drives. Every track is divided into these fragment units sectors .Sectors numbering starts from 1 unlike tracks which starts from 0.
Physical sectors are numbered relative to a track. To access any location on the disk the side number, track number and sector uniquely identifies the data. The sector numbering is done relative to the track under consideration.
Relative Sectors are numbered relative to the start of the disk. The disk starts at the outermost with cylinder 0, track 0. This sector is numbered as relative sector 0 the next sector 1 up to last sector on the disk.
Any of the above two methods can be used by the system for accessing the data.
Cluster is a group of sectors. A cluster is always a power of two for example 1, 2, 4 or 8 sectors. For a 1.44MB floppy the cluster size is 1. That is 1 sector/cluster. This is usually done for accessing a bigger amount of data and avoiding too many read operations. However it also has a disadvantage as we shall soon see.
The Disk System Area
The disk system area for a preformatted disk starts from the start of the disk. That is cylinder 0, track 0, Sector 1.When the computer starts up the BIOS loads this area only. Since its just 1 sector (512 bytes) only the most important things are done in this part of the disk. This area of the disk contains 3 main parts
a) BOOT RECORD also called MBR
FAT (Both Entries)
c) Directory Entry
Now we take a look at what these things mean
The boot record contains information about what to do after the POST (Power on Self Test) operation and it also contain information about the general layout of the disk for example the number of clusters, sectors per cluster number of root directories entry etc. The whole thing looks like this on the sector
Boot Record FAT Directory entry System Files User Data
The System files are copied to the data area at the time of formatting the diskette. In any case they are also treated the same as any other ordinary file and is kept in the same area as the user files, however since OS uses these files so they are kept at the very beginning and also with their attributes set to system files just to be safe from the user corrupting them.
The Location of each of these entries is as shown below in the table
Device Boot FAT Directory Sectors/Clusters
3.5” 720 Kb 0 1-6 7-13 2
3.5” 1.44MB 0 1-19 19-32 1
The above table shows the position of the sectors (relative). This shows that the boot sector is located in sector 0, the FAT is spread in next 18 sectors the Directory Entry in next 14 sectors for a 1.44MB diskette. Since 1 sector per cluster is allocated we can use the term cluster and sector interchangeably In this case however we are not going to so cluster is not equal to sector unless specified explicitly.
The following table shows the contents of the first sector that is the boot sector
00h jump to bootstrap routine at 3E h
03h Name / dos version number
0Bh Bytes / sector usually 200h(512)
0Dh sectors / cluster
0Eh Number of reserved sectors
10h Number of copies of FAT (1 or 2)
11h Number of root directories
13h Number of disk sectors if volume < 32MB
15h Media descriptor byte same as first byte in Fat
16h Number of sectors for FAT
18h Number of sectors / track
1Ah Number of R/W heads (sides)
1Ch Number of hidden sectors
1Eh Reserved by system
20h Total number of sectors if volume > 32 MB
24h Physical drive number (00h for A, for HDD C:=80h)
25h Reserved By the System
26h Extended Boot Sector Signature contains 29h
27h Volume ID
2Bh Volume Label
36h Reserved by system
3Eh-1FFh Bootstrap Loader begins Here
The Directory Entry
All files are stored on a cluster boundary. That means that although the smallest amount of accessible data is a sector, since the files are normally much bigger than 512 bytes therefore the OS uses clusters to hold files. This is just providing a larger space to a file and it is more efficient. The cluster is considered as an atomic unit that means that it is not possible to assign some amount of cluster to a file either a cluster is allocated or it is not. This also has a disadvantage in the form that if the file size is considerably smaller than the cluster size then the free space will be wasted.
For each file that is created a 32 byte entry is created in the directory. The contents of the directory are shown below
Offset (hex) Description
00-07 Filename. The first byte can also contain
00h File is never used
05h First Character of filename is E5h
2Eh File is subdirectory
E5h File has been deleted
08-0A File Extension
0B File attribute
00h normal file
01h read only
04h system file
08h volume label
20h archive file, wether file was rewritten Since last update.
If for example: the attribute is 07h it means
01h + 02h + 04h (read only +hidden +system)
0C-15 Reserved by system
16-17 Time of day when last modified / created Stored as hhhhh_mmmmmm_sssss i.e. 16 bits
18-19 Date when the file was last modified / created Stored as yyyyyyy_mmmm_ddddd i.e. 16 bits
1A-1B Starting cluster of file
1C-1F Size of file in bytes. System calculates and writes size of file in this field.
PS: For the fields whose data exceeds 1 byte, data is stored in reversed format i.e. Lower order byte followed by higher order byte.
The File Allocation Table
The purpose of the FAT is to allocate disk space as a sequence of clusters. There is a FAT entry for each cluster on the disk. Its like linked list of pointers through which we can follow every byte in the file. There are 2 copies of FAT maintained in case one gets corrupted the other is used for accessing the files.
The first entry in the FAT indicates the media type. This describes wether it’s a diskette or hard drive or some other disk type. The following describes the contents of 1st byte
F0h 3.5” 2 sided 18sectors / track(1.44MB) or 36 sectors /track(2.88MB)
F8h Hard Disk
F9h 3.5” 2 sided 9sectors / track(720 kb)
Second entry in FAT describes wether the FAT is 12 bit or 16 bit
The second entry contains FFFFh for 12 bit and FFFFFFh for 16 bit FAT. The FAT looks like this for above two
12-BIT F0 FF FF
16-BIT F8 FF FF FF
Working of the whole System
The FAT file system works in accordance with the directory entry and the File Allocation Table. The directory entry is used for both maintaining files and directories. The directory entry provides the entry point for a file since it has the field for starting cluster of the file. The rest of the clusters are obtained from the allocation table. The whole file allocation table is actually just pointer entries as to where to find the next cluster. The entries are relative to previous cluster.
For example if we have a file that starts on cluster 2 and then continues on to 3rd cluster and finishes off at 4th cluster then the corresponding FAT entry at for cluster 2 will contain 3 , FAT entry for cluster 3 will contain 4. The EOF is marked with an FFF for a 12 bit FAT and FFFF for 16 bit FAT. Therefore entry 4-5 will have FFFF to mark EOF.
Trick for Reading the FAT entries
A) If 12 bit FAT is being used multiply the current cluster number with 1.5.
Access the FAT entry for this cluster number thus obtained also next to this one.
C) Reverse the digits obtained from these two. Use first 3 digits if the cluster number that was multiplied was odd and last three if it was even.
D) Repeat the process until you find the cluster with contents FFFh which will mark EOF.
E) For 16 Bit FAT step C need not be done and EOF is marked with FFFFh.
Total Files and Directories that can be made on 1.44MB disk with 12 bit FAT
Now since for each file allocated there is a directory entry of 32 bytes therefore total number of files / directories for the root directory can be calculated as follows
Sectors available for Directory Entry = 32-19+1= 14
Total Bytes available for Directory Entry = 14 * 512
Total files / directories that can be made in root directory
512*14 / 32 = 224
Now even if you make a file with nothing on it, after creating 224 files / directories you won’t be able to make any file or directories in the root directory.
However you may still make some files in the subdirectory if there is enough space left on the FAT. Since a FAT is 18 sectors wide that means 18*512 bytes and we have a 12 bit entry for each cluster therefore maximum available FAT will be
18*512/1.5 = 6Kb.So unless all these are filled up its possible to create files / directories in the subdirectory.
PS: We did try this on Virtual PC. You can write a C/C++ program to write to floppy as many files/ directories as you can. Compare the results with above.
because virus easily attack the hardisk with fat file system
is it true?
A wee correction... The FAT area on Fat12 may total 18 sectors, but this area contains both the FAT and the second copy of the FAT, so the FAT space is actually 9 sectors (not 18). Which gives 9 x 512B = 4608 Bytes available for FAT entries, divided by 1.5Bytes (12 bits) per entry = 3072 entries possible.
-reply by Chris Downs
|Get User Input From Vbscript For Batch Files Get user input from vbscript (4)||(0) The Fat File System - Part 2 Processing of Files|