Sunday, May 22, 2011
di
2:39 AM
|
0
komentar
Understanding FAT32 Filesystems
This page is intended to help you understand how to access data on Microsoft FAT32 filesystems, commonly Used on hard drives ranging in size from 500 megs to hundreds of gigabytes. This page is intended to help you understand how to access data on Microsoft FAT32 filesystems, commonly used on the hard drive sizes ranging from 500 MB to hundreds of gigabytes. FAT is a Relatively simple and unsophisticated filesystems That is understood by Nearly all operating systems, Including Linux and MacOS, so it's usually a common choice for firmware-based projects That need to access hard drives. FAT is a filesystem which is relatively simple and sophisticated that is understood by virtually all operating systems, including Linux and MacOS, so usually a common choice for firmware-based projects that need to access the hard drive. FAT16 and FAT12 are very similar and Used on Smaller disks. FAT16 and FAT12 are very similar and used on a smaller disk. This page will from concentrate on FAT32 only (to keep it simple), and briefly mention two other "Nowhere are these different. This page will concentrate on FAT32 only (to keep it simple), and briefly mention where the other two are different.
The official FAT specification is available from Microsoft, complete with a software "license agreement". The specifications of the official FAT available from Microsoft, complete with a "software license" agreement. Saddly, the document from Microsoft is hard to read if you do not already understand the FAT filesystem structure, and it lacks information about disk partitioning Also the which must be dealt with to properly use standard hard drives. Saddly, documents from Microsoft is difficult to read if you do not understand the structure of the FAT filesystem, and do not have information about disk partitions must also be handled with care using a standard hard drive. While May you find the Microsoft spec useful, this page is meant to "stand alone" ... Although you may find useful Microsoft spec, this page is intended to "stand alone" ... cans and you simply read it without Suffering through 3 pages of legalese! and you can simply read it without suffering through 3 page legalese!
However, this page will from intentionally "gloss over" many small details and omit many of the finer points, in an attempt to keep it simple and easy to read for anyone faced with learning FAT32 without any previous exposure. However, this page intentionally will "hide" the small details and omit many important points, in an effort to keep it simple and easy to read for anyone faced with learning FAT32 without previous exposure.
Where To Start ... Where To Begin ... How About At The Beginning How About At Home
The first sector of the drive is Called the Master Boot Record (MBR). The first sector of this drive called the Master Boot Record (MBR). You can read it with LBA = 0. You can read it with LBA = 0. For any new projects, you Should not even worry about accessing a drive in CHS mode, LBA as just numbers the sectors sequentially starting at zero, the which is much Simpler. For each new project, even you do not have to worry about accessing the drive in CHS mode, as a mere LBA sector numbers sequentially starting from zero, which is much more simple. All IDE drives support accessing sectors using LBA. All IDE drives support accessing sectors using LBA. Also, all IDE drives use sectors That are 512 bytes. Also, all IDE drives use a 512 byte sector. Recent Microsoft operating systems refer to using larger sectors, but the drives still use 512 bytes per sector and MS is just Treating multiple sectors as if They were the resource persons one sector. Recently Microsoft operating systems refer to using larger sectors, but still use the drive is 512 bytes per sector and MS is only treating the various sectors as if they were one sector. The remainder of this page will from only refer to LBA address of 512 byte sectors. The remainder of this page will only refer to LBA address of 512 byte sectors.
The first 446 bytes of the MBR are code That boots the computer. That the first 446 bytes of MBR are code that boots the computer. This is followed by a 64-byte partition table, and the last two bytes are always 0x55 and 0xAA. This was followed by 64-byte partition table, and two of the last byte is always 0x55 and 0xAA. You Should always check these last two bytes, as a simple "Sanity check" that the MBR is ok. You should always check the last two bytes, as a "sanity check" simple that the MBR is ok.
Figure 1: MBR (first sector) layout of Figure 1: MBR (first sector) layout
The MBR cans Represent only four partitions. MBR can only represent four partitions. A technique called "extended" partitioning is Used to Allow More Than Four, and Often times it is Used More Than Pls there are two partitions. technique called "extended" partition is used to allow more than four, and often used when there are more than two partitions. All we're going to say about extended partitions Is That They Appear in this table just like a normal partition, and Their first sector has another partition table describes the partitions That Within its space. All we will say about extended partitions is that they appear in this table just like a normal partition, and the first sector they have another partition table that describes the partition in the space. But for the sake of simply getting Some code to work, we're going to not worry about extended partitions (and repartition and reformat any drives Them That has ....) The most common scenario is only one partition using the whole drive, with partitions 2, 3 and 4 are blank. But for for the sake of just getting some code to work, we will not worry about extended partitions (and repartition and reformat any drive that has them ....) The most common scenario is only one partition using the entire drive, with partitions 2, 3 and 4 blank.
EACH partition description is just 16 bytes, and the good news, Is That You can usually just ignore most of Them. Each partition description is only 16 bytes, and the good news is that you can usually just ignore most of them. The fifth byte is a Type Code That tells what type of filesystem is supposed to be contained Within the partition, and the ninth through twelth bytes indicate the LBA Begin address Nowhere That Begins on the disk partition. The fifth byte is a Type Code that tells what kind of filesystem should be contained in the partition, and ninth through twelth bytes indicate the LBA Begin address where the partition starts on the disk.
Figure 2: The 16-byte partition entry Figure 2: byte partition entries-16
Normally you only need to check the Type Code of EACH entry, or looking for Either 0x0B 0x0C (the two That Are Used for FAT32), and then read the LBA Begin to learn WHERE the FAT32 filesystem is located on the disk. Usually you only need to check the Type Code of each entry, looking good or 0x0C 0x0B (two are used for FAT32), and then read the LBA Begin to learn where the FAT32 file system is located on the disk.
TODO: add a table of known type codes, with the FAT32 ones Colored TODO: Add code table of known species, the FAT32-colored
Warning Warning Winhex winhex
Several people have attempted to read the MBR (LBA = 0) with Winhex, and Actually ended up reading the FAT volume ID sector. Some people have tried to read the MBR (LBA = 0) with winhex, and actually end up reading the Volume ID FAT sector. When using Winhex, May addressing some sectors relative to your windows partition. When using winhex, addressing sector may be relative to your windows partition.
The Number of Sectors field is cans be checked to make sure you do not access (particularly write) beyond the end of the space That Is Allocated for the parition. Sector Number field can be checked to ensure you do not access (particularly write) beyond the end of the space allocated for the application partition. However, the FAT32 file system Itself contains information about its size, so this Number of Sectors field is redundant. However, the FAT32 file system itself contains information about size, so this field is the excessive number of sectors. Several of Microsoft's operating systems ignore it and instead Rely on the size information embedded Within the first sector of the filesystem. Some Microsoft operating system to ignore it and instead depend on the size of the information embedded in the first sector of the file system. (Yes, I have experimentally verified this, though unintentionally:) Linux checks the Number of Sectors field and properly prevents access beyond the Allocated Space. (Yes, I have this verification experiment, even if unintentionally:) Linux checks Number of Sectors field and properly prevents access outside the allocated space. Most firmware will of probably ignore it. Most firmware will probably ignore it.
The Boot Flag, CHS Begin, and CHS End fields Should Be ignored. Boot Flag, CHS Begin, and CHS End field must be ignored.
FAT32 Volume ID ... FAT32 Volume ID ... Yet Another First Sector Sector Yet Another First
The first step to reading the FAT32 filesystem is the read its first sector, Called the Volume ID. The first step to read the FAT32 file system is read the first sector, called the ID volume. The Volume ID is read using the LBA Begin address found from the partition table. Volume ID read using Start LBA addresses found from the partition table. From this sector, you will from extract information That tells you everything you need to know about the physical layout of the FAT32 filesystem. From this sector, you will extract the information that tells you everything you need to know about the physical layout of the FAT32 file system.
Microsoft's specification lists many variables, and the FAT32 Volume ID is Slightly different Than the older ones Used for FAT16 and FAT12. Microsoft specification lists many variables, and the FAT32 Volume ID is slightly different from the older which is used to FAT16 and FAT12. Fortunately, most of the information is not needed for simple code. Fortunately, most of the information is not required for simple code. Only four variables are required, and three others Should Be checked to make sure They have the expected values. Only four variables are needed, and three others should be checked to ensure that they have the expected values.
Figure 4: FAT32 Volume ID, the critical fields Figure 4: FAT32 Volume ID, the field of critical
Microsoft's Name Field Field Name Offset Offsetting Microsoft's Size Size Value Value
Bytes Per Sector Bytes Per Sector BPB_BytsPerSec BPB_BytsPerSec 0x0B 0x0B 16 Bits 16 Bits Always Always 512 Bytes 512 Bytes
Sectors Per Cluster Sectors Per Cluster BPB_SecPerClus BPB_SecPerClus 0x0D 0x0D 8 Bits 8 Bits 1,2,4,8,16,32,64,128 1,2,4,8,16,32,64,128
Number of Reserved Sectors Number of Reserved Sectors BPB_RsvdSecCnt BPB_RsvdSecCnt 0x0E 0x0e 16 Bits 16 Bits Usually Usually 0x20 0x20
Total Number of FATS FATS BPB_NumFATs BPB_NumFATs 0x10 0x10 8 Bits 8 Bits Always 2 Always 2
Sectors Per FAT Sectors Per FAT BPB_FATSz32 BPB_FATSz32 0x24 0x24 32 Bits 32 Bits Depends on disk size depends on the size of the disk
Root Directory First Cluster Root Directory First Cluster BPB_RootClus BPB_RootClus 0x2C 0x2C 32 Bits 32 Bits Usually Usually 0x00000002 0x00000002
Signature Signature (none) (None) 0x1FE 0x1FE 16 Bits 16 Bits Always Always 0xAA55 0xAA55
After checking the three fields to make sure the filesystem is using 512 byte sectors, 2 fats, and has a correct signature, you May Want To "boil down" These variables are read from the MBR and Volume ID into just four simple numbers That are needed for accessing the FAT32 filesystem. After examining three areas to ensure the filesystem to use 512 byte sectors, 2 fats, and have the correct signature, you might want to "boil down" these variables read from the MBR and Volume ID to just four simple numbers needed to access the FAT32 file system . Here are simple Formulas in C syntax: Here's a simple formula in C syntax:
(Unsigned long) fat_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors, (unsigned long) fat_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors;
(Unsigned long) cluster_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors (Number_of_FATs * Sectors_Per_FAT), (unsigned long) cluster_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors (Number_of_FATs * Sectors_Per_FAT);
(Unsigned char) sectors_per_cluster = BPB_SecPerClus, (unsigned char) sectors_per_cluster = BPB_SecPerClus;
(Unsigned long) root_dir_first_cluster = BPB_RootClus, (unsigned long) root_dir_first_cluster = BPB_RootClus;
As you can see, most of the information is needed only to learn the location of the first cluster and the FAT. As you can see, most of the information needed only to know the location of the first cluster and the FAT. You will of need to remember the size of the clusters and WHERE the root directory is located, but the other information is usually not needed (at least for simply reading files). You will need to remember the size of the cluster and where the root directory is located, but other information is usually not necessary (at least for read only files.)
If you compare these Formulas to the ones in Microsoft's specification, Should you notice two differences. If you compare this formula to that in Microsoft's specifications, you will notice two differences. They lack "RootDirSectors" Because FAT32 stores the root directory of the Same way as files and subdirectories, so RootDirSectors is always zero with FAT32. They are less "RootDirSectors", because FAT32 stores the root directory the same way as files and subdirectories, so RootDirSectors always zero with FAT32. For FAT16 and FAT12, this extra step is needed to compute the special space Allocated for the root directory. For FAT16 and FAT12, additional steps needed to calculate the specific space allocated for root directory.
Microsoft's Formulas do not show the "Partition_LBA_Begin" term. Microsoft does not show formula "Partition_LBA_Begin" long. Their Formulas are all relative to the beginning of the filesystem, the which They do not explicitly state very well. formula they are all relative to the initial filesystem, which does not explicitly state they are very good. You must add the "Partition_LBA_Begin" term found from the MBR to compute correct LBA addresses for the IDE interface, Because the MBR to the drive is at zero, not the Volume ID. You should add "Partition_LBA_Begin" a term found in the MBR to calculate the correct address LBA for IDE interface, because to drive MBR is zero, not the ID volume. Not adding Partition_LBA_Begin is one of the most common errors developers make most, so especially if you are using Microsoft's spec, do not forget to add this for correct LBA addressing. Do not add Partition_LBA_Begin is one of the most common mistake most make the developer, so especially if you use the Microsoft spec, do not forget to add this to true LBA address.
The rest of this page will from usually refer to "fat_begin_lba", "cluster_begin_lba", "sectors_per_cluster", and "root_dir_first_cluster", rather Than the individual fields from the MBR and Volume ID, Because it is easiest to compute these numbers Pls starting up and then you no longer need all the details from the MBR and Volume ID. Remainder of this page will typically refer to "fat_begin_lba", "cluster_begin_lba", "sectors_per_cluster", and "root_dir_first_cluster", rather than their respective fields from the MBR and Volume ID, because the easiest to calculate these figures when it started and then you do not need again all the details of the MBR and Volume ID.
Bad Sector Bad Sectors
In the old days, disk drives Had "bad" sectors. In the old days, the disk drive has been "bad" sectors. Often Would drives Brand new installments have bad sectors, and as the drive was Used (or abused), additional Would sectors changed from unusable. Brand new drive will often have some bad sectors, and as the drives are used (or abused), additional sectors will become unusable.
The FAT filesystems are Designed to handle bad sectors. FAT filesystem that is designed to handle bad sectors. This is done by Storing two identical copies of the File Allocation Table. This is done by storing two identical copies of the File Allocation Table. The idea Is That if a sector Within Becomes FAT bad one, the corresponding sectors in the other FAT earnest (hopefully) still be good. The idea is that if a sector in one FAT becomes worse, other related sectors in the FAT will (hopefully) still good.
Within the clusters bad sectors are handheld by a special code Storing Within the FAT entry That That represents the cluster contains the bad sectors. Bad sectors in the cluster is handled by the store a special code in the FAT entry is a cluster that contains bad sectors. If a file That happened to be using the cluster, well, you lost part of the file's data, but at least That cluster would be marked as bad so That Used It would never be again. If the file is going to happen by using the cluster, well, you lose part of the data file, but at least the cluster which will be marked as bad so it will not ever be used again. The initial formatting of the disk Would write and read every sector and mark the bad clusters before They Could Be Used, so the data loss only occur Pls Could a Previously Became bad-good sector. Format beginning of the disk will write and read every sector and marks bad clusters before they can be used, so that data loss can only occur if the previous sector-both for the worse.
Fortunately, bad sectors today are only a distant memory, at least on hard drives. Fortunately, bad sector is now only a distant memory, at least on the hard drive. Modern drives still internally media experience errors, but They store Reed-Solomon error correcting codes for every sector. Modern internal drives are still experiencing media errors, but they save the Reed-Solomon error correcting codes for each sector. Sector Data cans be interleaved and distributed over a wide area, so a physical defect (localized to one place) cans of damage only a small part of many sectors, rather Than all of A Few sectors. Sector data can be inserted and distributed in a vast area, so that physically disabled (translated into one spot) can damage only a fraction of the various sectors, rather than any number of sectors. The error correction Few cans Easily recover the missing bits of EACH sector. Correction of errors can easily return the bits that are missing some of each sector. Also error correction dramatically increases storage capacity (despite using space to store redundant data), Because the bits cans be packed so close together That a small number of errors begin to occur, and the error correction fixes Them. Error correction also dramatically increase the storage capacity (although the use of space to store backup data), because the bits can be packed so close together that a small number of errors began to occur, and corrective repair their mistakes.
All modern drives Also include extra storage capacity That Is Used to automatically remap Damaged sectors. All modern drives also include additional storage capacity that is used to automatically remap bad sectors. When a sector is read and too many of the bits needed error correction, the controller in the drive will of "move" that sector to a fresh portion of the space set aside for remapping sectors. When the public sector and too many bits of error correction is required, the controller at the drive will "move" that the sector for some fresh space set aside for mapping the sector. Also remapping dramatically reduces the cost of disk drives, Because small but common defects in manufacturing do not impact overall product quality. Mapping also dramatically reduce the cost of disk drives, because of small but common defects in manufacturing does not affect overall product quality.
Because all modern drives use sophisticated error correction to automatically detect and (Almost always) correct for media errors, bad sectors are virtually never seen at the IDE interface level. Because all modern drives use error correction technology to automatically detect and (almost always) true for media errors, bad sectors are almost never seen at the level of the IDE interface.
How The FAT32 filesystem is FAT32 Filesystem Is Arranged How Are Regulated
The layout of a FAT32 file system is simple. The layout of the FAT32 file system is simple. The first sector is always the Volume ID, the which is followed by Some unused space Called the reserved sectors. The first sector is always ID volume, followed by some unused space called the reserved sector. Following the reserved sectors are two copies of the FAT (File Allocation Table). After the reserved sectors are two copies of the FAT (File Allocation Table). The remainder of the file system data is Arranged in "clusters", with Perhaps a tiny bit of unused space after the last cluster. The rest of the filesystem is data arranged in "clusters", with perhaps a little unused space after the last cluster.
Figure 5: FAT32 Filesystem Overall Layout Figure 5: Overall Layout FAT32 Filesystem
The vast majority of the disk space is the clusters section, the which is Used to hold all the files and directories. Most of the disk space is part of the cluster, which is used to store all files and directories. The clusters begin Their numbering at 2, so there is no cluster # 0 or cluster # 1. Cluster start their numbering at 2, so that no cluster or clusters # 0 # 1. To access any particular cluster, you need to use this formula to turn the cluster number into the LBA address for the IDE drive: To access a particular cluster, you need to use this formula to change the number of clusters to address LBA for IDE drive:
lba_addr = cluster_begin_lba (cluster_number - 2) * sectors_per_cluster;
Normally clusters are at least 4k (8 sectors), and sizes of 8k, 32k and 16K are Also Used widely. Usually cluster at least 4k (8 sectors), and the size of 8k, 32k and 16k are also widely used. Some later versions of Microsoft Windows allow using even larger cluster sizes, by effectively considering the sector size to be Some mulitple of 512 bytes. Some versions of Microsoft Windows allow using a larger cluster size, with effective considering the size of the sector to be some mulitple of 512 bytes. The FAT32 specification from Microsoft states That 32k is the maximum cluster size. FAT32 specification from Microsoft state that 32k is the maximum cluster size.
Now If Only We Knew Where The Files Were .... Now If Only We Know Where Files Are ....
When you begin, you only know the first cluster of the root directory. When you start, you only know the first cluster of root directory. Reading the directory will from reveal the names and location of first cluster of other files and subdirectories. Reading directory will reveal the name and location of the first cluster of files and subdirectories. Is That A key point directories only tell you how to find the first cluster number of Their files and subdirectories. A key point is that the directory only tells you how to find the first cluster number of files and subdirectories. Also you obtain a variety of other info from the directory Such as the file's length, modification time, attribute bits, etc, but only a directory tells you WHERE the files begin. You also get various other info from the directory as the file length, modification time, attribute bits, etc., but only tells you the directory where the file begins. To Access More Than the first cluster, you will of need to use the FAT. To access more than the first cluster, you will need to use FAT. But first We need to be Able to find those files start Nowhere. But first we must be able to find where the files begin.
In this section, We'll only briefly look at directories as much as is Necessary to learn WHERE the files are, then We'll look at how to access the rest of a file using the FAT, and later We'll Revisit directory structure in more detail. In this section, we will only briefly look at the directory as needed to learn where the file, then we will see how to access all the files using the FAT, and then we will return the directory structure in more detail.
Directory data is organized in 32 byte records. The data directory is organized in 32 byte records. This is nice, Because any sector holds exactly 16 records, and no directory record will from ever cross a sector boundry. This is nice, because every sector has the correct 16 record, and no record will ever cross-border directory sector. There are four types of 32-byte directory records. There are four types of 32-byte directory records.
1. Normal records with short filename - Attrib is normal Normal records with short filename - Attrib is normal
2. Long filename text - Attrib has all four type bits set the length of the text file name - Attrib has all four type bits set
3. Unused - First byte is 0xE5 Not used - the first byte is 0xE5
4. End of directory - First byte is zero End of directory - First byte is zero
Unused directory records are a result of deleting files. directory records that are not used due to deleting files. The first byte is overwritten with 0xE5, and later Pls a new file is created it cans be reused. The first byte is overwritten with 0xE5, and later when a new file created can be reused. At the end of the directory is a record That Begins with zero. At the end of the directory is a record that starts with zero. All other records will from some non-zero in. Their first byte, so this is an easy way to determine Pls you have reached the end of the directory. All other records will be non-zero in their first byte, so this is an easy way to determine when you've reached the end of the directory.
Records That do not begin with 0xE5 or zero are actual data directory, and the format of cans be determined by checking the Attrib byte. Note that does not begin with 0xE5 or zero are the actual directory data, and format can be determined by checking the Attrib byte. For now, We are only going to be Concerned with the normal directory records That have the old 8.3 short filename format. For now, we will only care about normal directory record that has the old 8.3 filename format short. In FAT32, all files and subdirectories have short names, even if the user Gave the file a longer name, so you cans access all files without needing to decode the long filename records (as long as your code simply ignores Them). On FAT32, all files and subdirectories have a short name, even if the user provides long file names, so you can access all the files without the need to decode the note long file name (as long as the code you just ignore them). Here is the format of a normal directory record: Here is a normal directory record format:
Figure 6: 32 Byte Directory Structure, Short Filename Format Figure 6: 32 Byte Directory Structure, Short Filename Format
Field Field Name Microsoft Name Microsoft's Size Size Offset Offsetting
Short Short Filename Filename DIR_Name DIR_Name 0x00 0x00 11 Bytes 11 Bytes
Attrib Attrib Byte Byte 0x0B 0x0B DIR_Attr DIR_Attr 8 Bits 8 Bits
First Cluster High First Cluster High DIR_FstClusHI DIR_FstClusHI 0x14 0x14 16 Bits 16 Bits
First Cluster Low Low First Cluster DIR_FstClusLO DIR_FstClusLO 0x1A 0x1A 16 Bits 16 Bits
File Size File Size DIR_FileSize DIR_FileSize 0x1C 0x1C 32 Bits 32 Bits
The Attrib byte has six bits defined, as shown in the table below. Attrib Byte has six bits defined, as shown in the table below. Most simple firmware will of checking the Attrib byte to determine if the 32 bytes are a normal or long filename data record, and to determine if it is a normal file or a subdirectory. Most simple firmware will check the Attrib byte to determine whether the 32 bytes is the normal record or data file name length, and to determine whether it is a normal file or subdirectory. Long filename records have all four of the least significant bits set. Long file names have a record of all the four most significant bits set. Normal files rarely have any of these four bits set. Normal files rarely have one of the four bits set.
Attrib Attrib Bit Bit Function Function LFN LFN Comment Comments
0 (LSB) 0 (LSB) Read Only Read Only 1 1 Should not allow writing should not be allowed to write
Hidden Hidden 1 1 1 1 Should not show in directory listings should not appear in directory listings
2 2 1 1 System File System is the operating system operating system files
3 3 Volume ID Volume ID 1 1 Filename is the Volume ID Filename is the Volume ID
4 4 xx Directory Directory Is a subdirectory (32-byte records) A
This page is intended to help you understand how to access data on Microsoft FAT32 filesystems, commonly Used on hard drives ranging in size from 500 megs to hundreds of gigabytes. This page is intended to help you understand how to access data on Microsoft FAT32 filesystems, commonly used on the hard drive sizes ranging from 500 MB to hundreds of gigabytes. FAT is a Relatively simple and unsophisticated filesystems That is understood by Nearly all operating systems, Including Linux and MacOS, so it's usually a common choice for firmware-based projects That need to access hard drives. FAT is a filesystem which is relatively simple and sophisticated that is understood by virtually all operating systems, including Linux and MacOS, so usually a common choice for firmware-based projects that need to access the hard drive. FAT16 and FAT12 are very similar and Used on Smaller disks. FAT16 and FAT12 are very similar and used on a smaller disk. This page will from concentrate on FAT32 only (to keep it simple), and briefly mention two other "Nowhere are these different. This page will concentrate on FAT32 only (to keep it simple), and briefly mention where the other two are different.
The official FAT specification is available from Microsoft, complete with a software "license agreement". The specifications of the official FAT available from Microsoft, complete with a "software license" agreement. Saddly, the document from Microsoft is hard to read if you do not already understand the FAT filesystem structure, and it lacks information about disk partitioning Also the which must be dealt with to properly use standard hard drives. Saddly, documents from Microsoft is difficult to read if you do not understand the structure of the FAT filesystem, and do not have information about disk partitions must also be handled with care using a standard hard drive. While May you find the Microsoft spec useful, this page is meant to "stand alone" ... Although you may find useful Microsoft spec, this page is intended to "stand alone" ... cans and you simply read it without Suffering through 3 pages of legalese! and you can simply read it without suffering through 3 page legalese!
However, this page will from intentionally "gloss over" many small details and omit many of the finer points, in an attempt to keep it simple and easy to read for anyone faced with learning FAT32 without any previous exposure. However, this page intentionally will "hide" the small details and omit many important points, in an effort to keep it simple and easy to read for anyone faced with learning FAT32 without previous exposure.
Where To Start ... Where To Begin ... How About At The Beginning How About At Home
The first sector of the drive is Called the Master Boot Record (MBR). The first sector of this drive called the Master Boot Record (MBR). You can read it with LBA = 0. You can read it with LBA = 0. For any new projects, you Should not even worry about accessing a drive in CHS mode, LBA as just numbers the sectors sequentially starting at zero, the which is much Simpler. For each new project, even you do not have to worry about accessing the drive in CHS mode, as a mere LBA sector numbers sequentially starting from zero, which is much more simple. All IDE drives support accessing sectors using LBA. All IDE drives support accessing sectors using LBA. Also, all IDE drives use sectors That are 512 bytes. Also, all IDE drives use a 512 byte sector. Recent Microsoft operating systems refer to using larger sectors, but the drives still use 512 bytes per sector and MS is just Treating multiple sectors as if They were the resource persons one sector. Recently Microsoft operating systems refer to using larger sectors, but still use the drive is 512 bytes per sector and MS is only treating the various sectors as if they were one sector. The remainder of this page will from only refer to LBA address of 512 byte sectors. The remainder of this page will only refer to LBA address of 512 byte sectors.
The first 446 bytes of the MBR are code That boots the computer. That the first 446 bytes of MBR are code that boots the computer. This is followed by a 64-byte partition table, and the last two bytes are always 0x55 and 0xAA. This was followed by 64-byte partition table, and two of the last byte is always 0x55 and 0xAA. You Should always check these last two bytes, as a simple "Sanity check" that the MBR is ok. You should always check the last two bytes, as a "sanity check" simple that the MBR is ok.
Figure 1: MBR (first sector) layout of Figure 1: MBR (first sector) layout
The MBR cans Represent only four partitions. MBR can only represent four partitions. A technique called "extended" partitioning is Used to Allow More Than Four, and Often times it is Used More Than Pls there are two partitions. technique called "extended" partition is used to allow more than four, and often used when there are more than two partitions. All we're going to say about extended partitions Is That They Appear in this table just like a normal partition, and Their first sector has another partition table describes the partitions That Within its space. All we will say about extended partitions is that they appear in this table just like a normal partition, and the first sector they have another partition table that describes the partition in the space. But for the sake of simply getting Some code to work, we're going to not worry about extended partitions (and repartition and reformat any drives Them That has ....) The most common scenario is only one partition using the whole drive, with partitions 2, 3 and 4 are blank. But for for the sake of just getting some code to work, we will not worry about extended partitions (and repartition and reformat any drive that has them ....) The most common scenario is only one partition using the entire drive, with partitions 2, 3 and 4 blank.
EACH partition description is just 16 bytes, and the good news, Is That You can usually just ignore most of Them. Each partition description is only 16 bytes, and the good news is that you can usually just ignore most of them. The fifth byte is a Type Code That tells what type of filesystem is supposed to be contained Within the partition, and the ninth through twelth bytes indicate the LBA Begin address Nowhere That Begins on the disk partition. The fifth byte is a Type Code that tells what kind of filesystem should be contained in the partition, and ninth through twelth bytes indicate the LBA Begin address where the partition starts on the disk.
Figure 2: The 16-byte partition entry Figure 2: byte partition entries-16
Normally you only need to check the Type Code of EACH entry, or looking for Either 0x0B 0x0C (the two That Are Used for FAT32), and then read the LBA Begin to learn WHERE the FAT32 filesystem is located on the disk. Usually you only need to check the Type Code of each entry, looking good or 0x0C 0x0B (two are used for FAT32), and then read the LBA Begin to learn where the FAT32 file system is located on the disk.
TODO: add a table of known type codes, with the FAT32 ones Colored TODO: Add code table of known species, the FAT32-colored
Warning Warning Winhex winhex
Several people have attempted to read the MBR (LBA = 0) with Winhex, and Actually ended up reading the FAT volume ID sector. Some people have tried to read the MBR (LBA = 0) with winhex, and actually end up reading the Volume ID FAT sector. When using Winhex, May addressing some sectors relative to your windows partition. When using winhex, addressing sector may be relative to your windows partition.
The Number of Sectors field is cans be checked to make sure you do not access (particularly write) beyond the end of the space That Is Allocated for the parition. Sector Number field can be checked to ensure you do not access (particularly write) beyond the end of the space allocated for the application partition. However, the FAT32 file system Itself contains information about its size, so this Number of Sectors field is redundant. However, the FAT32 file system itself contains information about size, so this field is the excessive number of sectors. Several of Microsoft's operating systems ignore it and instead Rely on the size information embedded Within the first sector of the filesystem. Some Microsoft operating system to ignore it and instead depend on the size of the information embedded in the first sector of the file system. (Yes, I have experimentally verified this, though unintentionally:) Linux checks the Number of Sectors field and properly prevents access beyond the Allocated Space. (Yes, I have this verification experiment, even if unintentionally:) Linux checks Number of Sectors field and properly prevents access outside the allocated space. Most firmware will of probably ignore it. Most firmware will probably ignore it.
The Boot Flag, CHS Begin, and CHS End fields Should Be ignored. Boot Flag, CHS Begin, and CHS End field must be ignored.
FAT32 Volume ID ... FAT32 Volume ID ... Yet Another First Sector Sector Yet Another First
The first step to reading the FAT32 filesystem is the read its first sector, Called the Volume ID. The first step to read the FAT32 file system is read the first sector, called the ID volume. The Volume ID is read using the LBA Begin address found from the partition table. Volume ID read using Start LBA addresses found from the partition table. From this sector, you will from extract information That tells you everything you need to know about the physical layout of the FAT32 filesystem. From this sector, you will extract the information that tells you everything you need to know about the physical layout of the FAT32 file system.
Microsoft's specification lists many variables, and the FAT32 Volume ID is Slightly different Than the older ones Used for FAT16 and FAT12. Microsoft specification lists many variables, and the FAT32 Volume ID is slightly different from the older which is used to FAT16 and FAT12. Fortunately, most of the information is not needed for simple code. Fortunately, most of the information is not required for simple code. Only four variables are required, and three others Should Be checked to make sure They have the expected values. Only four variables are needed, and three others should be checked to ensure that they have the expected values.
Figure 4: FAT32 Volume ID, the critical fields Figure 4: FAT32 Volume ID, the field of critical
Microsoft's Name Field Field Name Offset Offsetting Microsoft's Size Size Value Value
Bytes Per Sector Bytes Per Sector BPB_BytsPerSec BPB_BytsPerSec 0x0B 0x0B 16 Bits 16 Bits Always Always 512 Bytes 512 Bytes
Sectors Per Cluster Sectors Per Cluster BPB_SecPerClus BPB_SecPerClus 0x0D 0x0D 8 Bits 8 Bits 1,2,4,8,16,32,64,128 1,2,4,8,16,32,64,128
Number of Reserved Sectors Number of Reserved Sectors BPB_RsvdSecCnt BPB_RsvdSecCnt 0x0E 0x0e 16 Bits 16 Bits Usually Usually 0x20 0x20
Total Number of FATS FATS BPB_NumFATs BPB_NumFATs 0x10 0x10 8 Bits 8 Bits Always 2 Always 2
Sectors Per FAT Sectors Per FAT BPB_FATSz32 BPB_FATSz32 0x24 0x24 32 Bits 32 Bits Depends on disk size depends on the size of the disk
Root Directory First Cluster Root Directory First Cluster BPB_RootClus BPB_RootClus 0x2C 0x2C 32 Bits 32 Bits Usually Usually 0x00000002 0x00000002
Signature Signature (none) (None) 0x1FE 0x1FE 16 Bits 16 Bits Always Always 0xAA55 0xAA55
After checking the three fields to make sure the filesystem is using 512 byte sectors, 2 fats, and has a correct signature, you May Want To "boil down" These variables are read from the MBR and Volume ID into just four simple numbers That are needed for accessing the FAT32 filesystem. After examining three areas to ensure the filesystem to use 512 byte sectors, 2 fats, and have the correct signature, you might want to "boil down" these variables read from the MBR and Volume ID to just four simple numbers needed to access the FAT32 file system . Here are simple Formulas in C syntax: Here's a simple formula in C syntax:
(Unsigned long) fat_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors, (unsigned long) fat_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors;
(Unsigned long) cluster_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors (Number_of_FATs * Sectors_Per_FAT), (unsigned long) cluster_begin_lba = Partition_LBA_Begin Number_of_Reserved_Sectors (Number_of_FATs * Sectors_Per_FAT);
(Unsigned char) sectors_per_cluster = BPB_SecPerClus, (unsigned char) sectors_per_cluster = BPB_SecPerClus;
(Unsigned long) root_dir_first_cluster = BPB_RootClus, (unsigned long) root_dir_first_cluster = BPB_RootClus;
As you can see, most of the information is needed only to learn the location of the first cluster and the FAT. As you can see, most of the information needed only to know the location of the first cluster and the FAT. You will of need to remember the size of the clusters and WHERE the root directory is located, but the other information is usually not needed (at least for simply reading files). You will need to remember the size of the cluster and where the root directory is located, but other information is usually not necessary (at least for read only files.)
If you compare these Formulas to the ones in Microsoft's specification, Should you notice two differences. If you compare this formula to that in Microsoft's specifications, you will notice two differences. They lack "RootDirSectors" Because FAT32 stores the root directory of the Same way as files and subdirectories, so RootDirSectors is always zero with FAT32. They are less "RootDirSectors", because FAT32 stores the root directory the same way as files and subdirectories, so RootDirSectors always zero with FAT32. For FAT16 and FAT12, this extra step is needed to compute the special space Allocated for the root directory. For FAT16 and FAT12, additional steps needed to calculate the specific space allocated for root directory.
Microsoft's Formulas do not show the "Partition_LBA_Begin" term. Microsoft does not show formula "Partition_LBA_Begin" long. Their Formulas are all relative to the beginning of the filesystem, the which They do not explicitly state very well. formula they are all relative to the initial filesystem, which does not explicitly state they are very good. You must add the "Partition_LBA_Begin" term found from the MBR to compute correct LBA addresses for the IDE interface, Because the MBR to the drive is at zero, not the Volume ID. You should add "Partition_LBA_Begin" a term found in the MBR to calculate the correct address LBA for IDE interface, because to drive MBR is zero, not the ID volume. Not adding Partition_LBA_Begin is one of the most common errors developers make most, so especially if you are using Microsoft's spec, do not forget to add this for correct LBA addressing. Do not add Partition_LBA_Begin is one of the most common mistake most make the developer, so especially if you use the Microsoft spec, do not forget to add this to true LBA address.
The rest of this page will from usually refer to "fat_begin_lba", "cluster_begin_lba", "sectors_per_cluster", and "root_dir_first_cluster", rather Than the individual fields from the MBR and Volume ID, Because it is easiest to compute these numbers Pls starting up and then you no longer need all the details from the MBR and Volume ID. Remainder of this page will typically refer to "fat_begin_lba", "cluster_begin_lba", "sectors_per_cluster", and "root_dir_first_cluster", rather than their respective fields from the MBR and Volume ID, because the easiest to calculate these figures when it started and then you do not need again all the details of the MBR and Volume ID.
Bad Sector Bad Sectors
In the old days, disk drives Had "bad" sectors. In the old days, the disk drive has been "bad" sectors. Often Would drives Brand new installments have bad sectors, and as the drive was Used (or abused), additional Would sectors changed from unusable. Brand new drive will often have some bad sectors, and as the drives are used (or abused), additional sectors will become unusable.
The FAT filesystems are Designed to handle bad sectors. FAT filesystem that is designed to handle bad sectors. This is done by Storing two identical copies of the File Allocation Table. This is done by storing two identical copies of the File Allocation Table. The idea Is That if a sector Within Becomes FAT bad one, the corresponding sectors in the other FAT earnest (hopefully) still be good. The idea is that if a sector in one FAT becomes worse, other related sectors in the FAT will (hopefully) still good.
Within the clusters bad sectors are handheld by a special code Storing Within the FAT entry That That represents the cluster contains the bad sectors. Bad sectors in the cluster is handled by the store a special code in the FAT entry is a cluster that contains bad sectors. If a file That happened to be using the cluster, well, you lost part of the file's data, but at least That cluster would be marked as bad so That Used It would never be again. If the file is going to happen by using the cluster, well, you lose part of the data file, but at least the cluster which will be marked as bad so it will not ever be used again. The initial formatting of the disk Would write and read every sector and mark the bad clusters before They Could Be Used, so the data loss only occur Pls Could a Previously Became bad-good sector. Format beginning of the disk will write and read every sector and marks bad clusters before they can be used, so that data loss can only occur if the previous sector-both for the worse.
Fortunately, bad sectors today are only a distant memory, at least on hard drives. Fortunately, bad sector is now only a distant memory, at least on the hard drive. Modern drives still internally media experience errors, but They store Reed-Solomon error correcting codes for every sector. Modern internal drives are still experiencing media errors, but they save the Reed-Solomon error correcting codes for each sector. Sector Data cans be interleaved and distributed over a wide area, so a physical defect (localized to one place) cans of damage only a small part of many sectors, rather Than all of A Few sectors. Sector data can be inserted and distributed in a vast area, so that physically disabled (translated into one spot) can damage only a fraction of the various sectors, rather than any number of sectors. The error correction Few cans Easily recover the missing bits of EACH sector. Correction of errors can easily return the bits that are missing some of each sector. Also error correction dramatically increases storage capacity (despite using space to store redundant data), Because the bits cans be packed so close together That a small number of errors begin to occur, and the error correction fixes Them. Error correction also dramatically increase the storage capacity (although the use of space to store backup data), because the bits can be packed so close together that a small number of errors began to occur, and corrective repair their mistakes.
All modern drives Also include extra storage capacity That Is Used to automatically remap Damaged sectors. All modern drives also include additional storage capacity that is used to automatically remap bad sectors. When a sector is read and too many of the bits needed error correction, the controller in the drive will of "move" that sector to a fresh portion of the space set aside for remapping sectors. When the public sector and too many bits of error correction is required, the controller at the drive will "move" that the sector for some fresh space set aside for mapping the sector. Also remapping dramatically reduces the cost of disk drives, Because small but common defects in manufacturing do not impact overall product quality. Mapping also dramatically reduce the cost of disk drives, because of small but common defects in manufacturing does not affect overall product quality.
Because all modern drives use sophisticated error correction to automatically detect and (Almost always) correct for media errors, bad sectors are virtually never seen at the IDE interface level. Because all modern drives use error correction technology to automatically detect and (almost always) true for media errors, bad sectors are almost never seen at the level of the IDE interface.
How The FAT32 filesystem is FAT32 Filesystem Is Arranged How Are Regulated
The layout of a FAT32 file system is simple. The layout of the FAT32 file system is simple. The first sector is always the Volume ID, the which is followed by Some unused space Called the reserved sectors. The first sector is always ID volume, followed by some unused space called the reserved sector. Following the reserved sectors are two copies of the FAT (File Allocation Table). After the reserved sectors are two copies of the FAT (File Allocation Table). The remainder of the file system data is Arranged in "clusters", with Perhaps a tiny bit of unused space after the last cluster. The rest of the filesystem is data arranged in "clusters", with perhaps a little unused space after the last cluster.
Figure 5: FAT32 Filesystem Overall Layout Figure 5: Overall Layout FAT32 Filesystem
The vast majority of the disk space is the clusters section, the which is Used to hold all the files and directories. Most of the disk space is part of the cluster, which is used to store all files and directories. The clusters begin Their numbering at 2, so there is no cluster # 0 or cluster # 1. Cluster start their numbering at 2, so that no cluster or clusters # 0 # 1. To access any particular cluster, you need to use this formula to turn the cluster number into the LBA address for the IDE drive: To access a particular cluster, you need to use this formula to change the number of clusters to address LBA for IDE drive:
lba_addr = cluster_begin_lba (cluster_number - 2) * sectors_per_cluster;
Normally clusters are at least 4k (8 sectors), and sizes of 8k, 32k and 16K are Also Used widely. Usually cluster at least 4k (8 sectors), and the size of 8k, 32k and 16k are also widely used. Some later versions of Microsoft Windows allow using even larger cluster sizes, by effectively considering the sector size to be Some mulitple of 512 bytes. Some versions of Microsoft Windows allow using a larger cluster size, with effective considering the size of the sector to be some mulitple of 512 bytes. The FAT32 specification from Microsoft states That 32k is the maximum cluster size. FAT32 specification from Microsoft state that 32k is the maximum cluster size.
Now If Only We Knew Where The Files Were .... Now If Only We Know Where Files Are ....
When you begin, you only know the first cluster of the root directory. When you start, you only know the first cluster of root directory. Reading the directory will from reveal the names and location of first cluster of other files and subdirectories. Reading directory will reveal the name and location of the first cluster of files and subdirectories. Is That A key point directories only tell you how to find the first cluster number of Their files and subdirectories. A key point is that the directory only tells you how to find the first cluster number of files and subdirectories. Also you obtain a variety of other info from the directory Such as the file's length, modification time, attribute bits, etc, but only a directory tells you WHERE the files begin. You also get various other info from the directory as the file length, modification time, attribute bits, etc., but only tells you the directory where the file begins. To Access More Than the first cluster, you will of need to use the FAT. To access more than the first cluster, you will need to use FAT. But first We need to be Able to find those files start Nowhere. But first we must be able to find where the files begin.
In this section, We'll only briefly look at directories as much as is Necessary to learn WHERE the files are, then We'll look at how to access the rest of a file using the FAT, and later We'll Revisit directory structure in more detail. In this section, we will only briefly look at the directory as needed to learn where the file, then we will see how to access all the files using the FAT, and then we will return the directory structure in more detail.
Directory data is organized in 32 byte records. The data directory is organized in 32 byte records. This is nice, Because any sector holds exactly 16 records, and no directory record will from ever cross a sector boundry. This is nice, because every sector has the correct 16 record, and no record will ever cross-border directory sector. There are four types of 32-byte directory records. There are four types of 32-byte directory records.
1. Normal records with short filename - Attrib is normal Normal records with short filename - Attrib is normal
2. Long filename text - Attrib has all four type bits set the length of the text file name - Attrib has all four type bits set
3. Unused - First byte is 0xE5 Not used - the first byte is 0xE5
4. End of directory - First byte is zero End of directory - First byte is zero
Unused directory records are a result of deleting files. directory records that are not used due to deleting files. The first byte is overwritten with 0xE5, and later Pls a new file is created it cans be reused. The first byte is overwritten with 0xE5, and later when a new file created can be reused. At the end of the directory is a record That Begins with zero. At the end of the directory is a record that starts with zero. All other records will from some non-zero in. Their first byte, so this is an easy way to determine Pls you have reached the end of the directory. All other records will be non-zero in their first byte, so this is an easy way to determine when you've reached the end of the directory.
Records That do not begin with 0xE5 or zero are actual data directory, and the format of cans be determined by checking the Attrib byte. Note that does not begin with 0xE5 or zero are the actual directory data, and format can be determined by checking the Attrib byte. For now, We are only going to be Concerned with the normal directory records That have the old 8.3 short filename format. For now, we will only care about normal directory record that has the old 8.3 filename format short. In FAT32, all files and subdirectories have short names, even if the user Gave the file a longer name, so you cans access all files without needing to decode the long filename records (as long as your code simply ignores Them). On FAT32, all files and subdirectories have a short name, even if the user provides long file names, so you can access all the files without the need to decode the note long file name (as long as the code you just ignore them). Here is the format of a normal directory record: Here is a normal directory record format:
Figure 6: 32 Byte Directory Structure, Short Filename Format Figure 6: 32 Byte Directory Structure, Short Filename Format
Field Field Name Microsoft Name Microsoft's Size Size Offset Offsetting
Short Short Filename Filename DIR_Name DIR_Name 0x00 0x00 11 Bytes 11 Bytes
Attrib Attrib Byte Byte 0x0B 0x0B DIR_Attr DIR_Attr 8 Bits 8 Bits
First Cluster High First Cluster High DIR_FstClusHI DIR_FstClusHI 0x14 0x14 16 Bits 16 Bits
First Cluster Low Low First Cluster DIR_FstClusLO DIR_FstClusLO 0x1A 0x1A 16 Bits 16 Bits
File Size File Size DIR_FileSize DIR_FileSize 0x1C 0x1C 32 Bits 32 Bits
The Attrib byte has six bits defined, as shown in the table below. Attrib Byte has six bits defined, as shown in the table below. Most simple firmware will of checking the Attrib byte to determine if the 32 bytes are a normal or long filename data record, and to determine if it is a normal file or a subdirectory. Most simple firmware will check the Attrib byte to determine whether the 32 bytes is the normal record or data file name length, and to determine whether it is a normal file or subdirectory. Long filename records have all four of the least significant bits set. Long file names have a record of all the four most significant bits set. Normal files rarely have any of these four bits set. Normal files rarely have one of the four bits set.
Attrib Attrib Bit Bit Function Function LFN LFN Comment Comments
0 (LSB) 0 (LSB) Read Only Read Only 1 1 Should not allow writing should not be allowed to write
Hidden Hidden 1 1 1 1 Should not show in directory listings should not appear in directory listings
2 2 1 1 System File System is the operating system operating system files
3 3 Volume ID Volume ID 1 1 Filename is the Volume ID Filename is the Volume ID
4 4 xx Directory Directory Is a subdirectory (32-byte records) A
posted by
scraft business
