All info in this file was found on this webpage: https://en.wikipedia.org/wiki/Design_of_the_FAT_file_system NOTE: 80GB hard disks have 156,250,000 sectors (0x0950 2F90) FAT filesystems incorporate one or more File Allocation Tables (FAT) to denote which cluster(s) are in use and denote the next sequential cluster, if any, is used by the file occupying that specific cluster in a linked list format. The structure of the FAT filesystem begines with a Master Boot Record (MBR) which holds a jump instruction to bootload code, information regarding the name of the operating system that formatted the media, a BIOS Parameter Block (BPB), and code to be run on system boot to load the rest of the operating system, finally followed by a signature. The BIOS Parameter Block (BPB) can vary based on the version of FAT being used, but this document will focus on FAT32. The BPB is used to contain data specific to the current implementation of the filesystem, such as, but not limited to, the number of bytes per sector, disk geometry (if applicable), number of sectors per cluster, and number of FATs. The following table describes the Boot Sector's contents for FAT32 Boot Sector Offset Bytes Description ------------------------------------------------------------------------------------------------------------------ 0x000 3 Jump instruction to bypass unexecutable code, to the bootloader code contained later in the MBR 0x003 8 OEM Name (Padded with spaces). This value determines in which system the disk was formatted Documented as free for OEM use, though may not work with unrecognized names. 0x00B 2 Bytes per logical sector, in powers of two. The most common value is 512. Some operating systems don't support other sector sizes. 0x00D 1 Logical sectors per cluster. Allowed values are: 1, 2, 4, 8, 16, 32, 64, and 128. 0x00E 2 Number of reserved logical sectors. The number of logical sectors before the first FAT in the file system image. At least 1 for this sector, usually 32 for FAT32 (to hold extended boot sector, FS info sector, and backup boot sectors). 0x010 1 Number of FATs, almost always 2. RAM disks might use 1. 0x011 2 0 for FAT32. Maximum # of root directory entries for FAT12/16. 0x013 2 Total Logical Sectors, if less than 65536, otherwise 0. (See 0x020) 0x015 1 Media descriptor. 0xF8 for hard disks. 0x016 2 0 for FAT32, instead uses 0x024. Logical sectors per FAT for FAT12/16. 0x018 2 Physical sectors per track, unused for drives that no longer support CHS access. 0 indicates LBA mode 0x01A 2 Number of heads. Unused for non-CHS drives. 0 denotes LBA mode. 0x01C 4 Count of hidden sectors preceding the partition containing this FAT volume. Should be 0 on non-partitioned media 0x020 4 Total logical sectors, if greater than 65535, otherwise see 0x013. 0x024 4 Logical sectors per FAT. Byte 0x026 should not be 0x28 or 0x29 for use with non-FAT32 systems. 0x028 2 Drive description/mirroring flags. (bits 3-0: zero based number of active FAT if bit 7 set, otherwise all FATs are mirrored. Other bits reserved and should be 0) 0x02A 2 Version (X.x). High-byte stored at 0x02B. 0x02C 4 Cluster number of root directory start, typically 2 (first cluster) if it contains no bad sector. A cluster value of 0 is not officially allowed and can never indicate a valid root directory start cluster. 0x030 2 Logical sector number of FS Information Sector, typically 1. (Second of three FAT32 boot sectors) 0x032 2 First logical sector number of a backup copy of the three FAT32 boot sectors, typically 6. Values of 0 or 0xFFFF indicate no backup sectors available. 0x034 12 Reserved. 0x040 1 Physical drive number. 0x00 for first removable media, 0x80 for first fixed disk. Values 0x7F and 0xFF reserved for internal purposes such as remote or ROM boot and should never occur on disk 0x041 1 Reserved 0x042 1 Extended boot signature, should be 0x29. 0x043 4 Volume ID. Can be any value 0x047 11 Volume Label, padded with blanks. 0x052 8 File System Type, padded with blanks. 0x05A 420 Boot Code, which is used to load in the rest of the operating system. 0x1FE 2 Boot sector signature (0x55, 0xAA). FS Information Sector The 'FS Information Sector' was introduced in FAT32 for speeding up access time of certain operations (in particular, getting amount of free space). It is located at a logical sector number specified in the FAT32 BPB at 0x030. Offset Bytes Description ------------------------------------------------------------------------------------------------------------------ 0x000 4 FS Information Sector signature (0x52, 0x52, 0x61, 0x41). Used to disallow FAT12 and FAT16 mounting. 0x004 480 Reserved. Should be 0x00 on format, but not changed later. 0x1E4 4 FS Information Sector signature (0x72, 0x71, 0x41, 0x61). 0x1E8 4 Last known number of free data clusters on the volume, or 0xFFFFFFFF if unknown. Should be set to 0xFFFFFFFF during format and updated by the operating system later on. Must not be absolutely relied upon to be correct in all scenarios. Before using this value, the operating system should sanity check this value to be at least smaller or equal to the volumes count of clusters. 0x1EC 4 Number of most recently known to be allocated cluster. Should be set to 0xFFFFFFFF during format and updated by the system later on. With 0xFFFFFFFF the system should start at cluster 0x00000002. Must not be absolutely relied upon to be correct in all scenarios. Before using this value, the operating system should sanity check this value to be a valid cluster number on the volume. 0x1F0 12 Reserved. Should be 0x00 on format, but not relied upon and never changed later. 0x1FC 4 FS Information Sector signature (0x000055AA) (All four bytes should match before the contents of this sector should be assumed to be in valid format). If FS Information Sector is present on volume, the minimum allowed logical sector size is 512 bytes, otherwise it would be 128 bytes. Cluster Map A volume's data area is divided into identically sized 'clusters', small blocks of contiguous space. Cluster sizes vary depending on the type of FAT file system being used and the size of the partition. Typically cluster sizes lie somewhere between 2KB and 32KB. Each file may occupy one or more of these clusters depending on its size; thus a file is represented by a chain of these clusters (referred to as a singly linked list). However these clusters are not necessarily stored adjacent to one another on the disk's surface but are often instead 'fragmented' throughout the Data Region. Each version of the FAT file system uses a different size for FAT entries. Smaller numbers result in a smaller FAT, but waste space in large partitions by needing to allocate in large clusters. The FAT32 file system uses 32 bits per FAT entry, thus one entry spans four bytes in little-endian byte order. The four top bits of each bit are reserved for other purposes, cleared during format and should not be changed otherwise. They must be masked off before interpreting the entry as 28-bit cluster address. The 'File Allocation Table (FAT)' is a contiguous number of sectors immediately following the area of reserved sectors. It represents a list of entries that mapt to each cluster on the volume. Each entry records one of five things: -the cluster number of the next cluster in a chain, 0x00000001-0x0FFFFFF5 -a special 'end of cluster-chain (EOC)' entry that indicates the end of a chain, 0x0FFFFFFF -a special entry to mark a bad cluster, 0x0FFFFFF6-0x0FFFFFF7 -a zero to note that the cluster is unused, 0x00000000 For very early versions of DOS to recognize the file system, the system must have been booted from the volume or the volume's FAT must start with the volume's second sector (logical sector 1 with physical CHS address 0/0/2 or LBA address 1), that is, immediately following the boot sector. Operating systems assume this hard-wired location of the FAT in order to find the FAT ID in the FAT's cluster 0 entry on DOS 1.0-1.1 FAT diskettes, where no valid BPB is found. Example FAT: Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 00000000 F0 FF FF 0F FF FF FF 0F FF FF FF 0F 04 00 00 00 00000010 05 00 00 00 06 00 00 00 07 00 00 00 08 00 00 00 00000020 FF FF FF 0F 0A 00 00 00 14 00 00 00 0C 00 00 00 00000030 0D 00 00 00 0E 00 00 00 0F 00 00 00 10 00 00 00 00000040 11 00 00 00 FF FF FF 0F 00 00 00 00 FF FF FF 0F 00000050 15 00 00 00 16 00 00 00 19 00 00 00 F7 FF FF 0F 00000060 F7 FF FF 0F 1A 00 00 00 FF FF FF 0F 00 00 00 00 00000070 00 00 00 00 F7 FF FF 0F 00 00 00 00 00 00 00 00 Special entries The first two entries in a FAT store special values: The first entry (cluster 0 in the FAT) holds the FAT ID since MS-DOS 1.20 and PC DOS 1.1 (allowed values 0xF0-0xFF with 0xF1-0xF7 reserved) in bits 7-0, which is also copied into the BPB of the boot sector, offset 0x015 since DOS 2.0. The remaining 4 bits (FAT12), 8 bits (FAT16), or 20 bits (FAT32) of this entry are always 1. These values were arranged so that the entry would also function as an "trap-all" end-of-chain marker for all data clusters holding a value of zero. Additionally, for FAT IDs other than 0xFF (and 0x00) it is possible to determine the correct nibble and byte order (to be) used by the file system driver, however, the FAT file system officially uses a little-endian representation only. The second entry (cluster 1 in the FAT) nominally stores the end-of-cluster-chain marker as used by the formatter, but typically always holds 0x0FFFFFFF, that is, with the exception of bits 31-28 on FAT32 volumes these bits are normally always set. Some Microsoft operating systems, however, set these bits if the volume is not the volume holding the running operating system (that is, use 0xFFFFFFFF instead of 0x0FFFFFFF here). Some, but not all, operating systems may use the upper two bits (27-26 on FAT32) here as bitflags by setting them on shutdown and clearing them on startup. If bit 27 is not set when mounting the volume, the volume was not properly unmounted before shutdown or ejection, and thus is in an unknown and possibly 'dirty' state. On FAT32 volumes, the FS Information Sector may hold outdated data and thus should not be used. The operating system would then typically run SCANDISK or CHKDSK on the next startup to ensure and possibly reestablish the volume's integrity. If bit 26 is cleared, the operating system has encountered disk I/O errors on startup, a possible indication for bad sectors. Operating systems aware of this extension will interpret this as a recommendation to carry out a surface scan on the next boot. Because these first two FAT entries store special values, there are no data clusters 0 or 1. The first data cluster (after the root directory if FAT12/16) is cluster 2, and cluster 2 is by definition the first cluster of the data area. Cluster Values FAT entry values Data Description ------------------------------------------------------------------------------------------------------------------ 0x?0000000 Free Cluster; also used by DOS to refer to the parent directory starting cluster in '..' entries of subdirectories of the root directory on FAT12/16 volumes. Otherwise, if this value occurs in cluster chains (in directory entries of zero length or deleted files), file system implementations should treat this like an end-of-chain marker. 0x?0000001 Reserved for internal purposes; MS-DOS/PC DOS used this cluster value as a temporary non-free cluster indicator while constructing cluster chains during file allocation (only seen on disk if there is a crash or power failure in the middle of this process). If this value occurs in on-disk cluster chain, file system implementations should treat this like an end-of-chain marker. 0x?0000002- Used as data clusters; value points to next cluster. MS-DOS/PC DOS accept values up to 0x0FFFFFEF 0x?FFFFFEF (sometimes more; see below). 0x?FFFFFF0- Reserved in some contexts, or also used as data clusters in some non-standard systems. Volume sizes 0x?FFFFFF5 which would utilize these values as data clusters should be avoided, but if these values occur in existing volumes, the file system must treat them as normal data clusters in cluster-chains (ideally applying additional sanity checks), similar to what MS-DOS, PC DOS and DR-DOS do, and should avoid allocating them for files otherwise. 0x?FFFFFF6 Reserved; do not use. Volumes should not be created which would utilize this value as a data cluster, but if this occurs in existing volumes, the file system must treat it as a normal data cluster in cluster-chains (ideally applying sanity checks), and should avoid to allocate it for files otherwise. 0x?FFFFFF7 Bad sector in cluster or reserved cluster (since DOS 2.0). 0x?FFFFFF8- Last cluster in file (EOC). File system implementations must treat all these values as end-of-chain 0x?FFFFFFF marker at the same time. Most file system implementations use 0x0FFFFFFF as end-of-file marker when allocating files, but versions of linux before 2.5.40 used 0x0FFFFFF8. Also, some faulty file system implementations only accept 0x0FFFFFFF as a valid end-of-chain marker. File system implementations should check cluster values in cluster-chains against the maximum allowed cluster value calculated by the actual size of the volume and treat higher values as if they were end-of-chain markers as well. Size limits The FAT32 variant of the FAT file system has a clear limit based on the number of clusters and the number of sectors per cluster (1, 2, 4, ..., 128). FAT32 volumes have a maximum volume size of about 2,407GiB using 32-128 bytes/sector. Fragmentation See 'FAT32 behavior notes.txt' Directory Table A 'directory table' is a special type of file that represents a directory (also known as a folder). Since 86-DOS 0.42, each file or (since MS-DOS 1.40 and PC DOS 2.0) subdirectory stored within it is represented by a 32-byte entry in the table. Each entry records the name, extension, attributes (archive, directory, hidden, read-only, system and volume), the address of the first cluster of the file/directory's data, the size of the file/directory, and the date and (since PC DOS 1.1) also the time of last modification. Earlier versions of 86-DOS used 16-byte directory entries only, supporting no files larger than 16MB and no time of last modification. Aside from the root directory table in FAT12/16 file systems, which occupies the special 'Root Directory Region' location, all directory tables are stored in the data region. The actual number of entries in a directory stored in the data region can grow by adding another cluster to the chain in the FAT. The FAT file system itself does not impose any limits on the depth of a subdirectory tree for as long as there are free clusters available to allocate the subdirectories. Each entry can be preceded by 'fake entries' to support a VFAT long file name (LFN); see further below. Directory Entry Before Microsoft added support for long filenames and creation/access timestamps, bytes 0x0C-0x15 of the directory entry were used by other operating systems to store additional metadata, most notably the operating systems of the Digital Research Family stored file passwords, access rights, owner IDs, and filed deletion data there. While Microsoft's newer extensions are not fully compatible with these extensions by default, most of them can coexist in third-party FAT implementations. 32-byte directory entries, both in the Root Directory Region and in subdirectories, are of the following format: Offset Bytes Description ------------------------------------------------------------------------------------------------------------------ 0x00 8 Short file name, padded with spaces. The first byte can have the following special values 0x00 - Entry is available and no subsequent entry is in use. Also serves as an end marker when DOS scans a directory table. 0x05 - Initial character is actually 0xE5, or is marked for deletion 0x2E - 'Dot' entry; either '.' or '..' 0xE5 - Entry has been previously erased and/or is available. 0x08 3 Short file extension (padded with spaces) 0x0B 1 File Attributes: Bit Description 0 Read Only. If this bit is set, the OS will not allow a file to be opened for modification 1 Hidden. Hides files or directories from normal directory views. 2 System. Indicates that the files belongs to the system and must not be physically moved (such as during defragmentation), because there may be references into the file using absolute addressing bypassing the file system (boot loaders, kernel images, swap files, extended attributes, etc.). 3 Volume Label. Indicates an optional directory volume label, normally only residing in a volume's root directory. Ideally the volume label should be the first entry in the directory (after reserved entries) in order to avoid problems with VFAT LFNs. If this volume label is not present some systems may fall back to display the partition volume label instead, if an EBPB is present in the boot sector. Even if this volume label is present, partitioning tools like FDISK may display the partition volume label instead. The entry occupies a directory entry but has no associated with it. Volume labels have a filesize entry of zero. 4 Subdirectory. Indicates that the cluster-chain associated with this entry gets interpreted as a subdirectory instead of as a file. Subdirectories have a filesize of zero. 5 Archive. Typically set by the operating system as soon as the file is created or modified to mark the file as 'dirty', and reset by backup software once the file has been backed up to indicate 'pure' state. 6 Device (internally set for character device names found in filespecs, never found on disk), must not be changed by disk tools. 7 Reserved, must not be changed by disk tools. 0x0C 1 Password and aux access flags. Unused in FAT32. 0 Read requires password. 1 Write requires password. 2 Delete requires password. 3 Reserved. 4 F4: Disable checksums 5 F3: Ignore Close Checksum Error 6 F2: Parial close default 7 F1: Modify default open rules 0x0D 1 First character of a deleted file, and create time in tens of milliseconds (0-199) 0x0E 2 Password hash, if password included. Otherwise create time in the following arrangement: 15-11 - Hours (0-23) 10-5 - Minutes (0-59) 4-0 - Seconds/2 (0-29) 0x10 2 Create date. The year, month, and day are encoded according to the following bitmap: 15-9 - Year (0=1980, 119 = 2099 supported under DOS/Windows, theoretical maximum of 127 = 2107) 8-5 - Month (1-12) 4-0 - Day (1-31) 0x12 2 Last access date, see 0x10 for format description. 0x14 2 High two bytes of first cluster number, low two bytes stored at 0x1A. 0x16 2 Last modified time, see 0x0E for format description. 0x18 2 Last modified date, see 0x10 for format description. 0x1A 2 Low two bytes of first cluster. Entries with the Volume Label flag, subdirectory, '..', and empty files with size zero should have first cluster 0. 0x1C 4 File size in bytes. Entries with the Volume Label or Subdirectory flag should have a size of 0.