FAT, or File Allocation Table, is a file system that is designed to keep track of allocation status of clusters on a hard drive. Developed in 1977 by Microsoft Corporation, FAT was originally intended to be a file system for the Microsoft Disk BASIC interpreter. FAT was quickly incorporated into an early version of Tim Patterson's QDOS, which was a moniker for "Quick and Dirty Operating System". Microsoft later purchased the rights to QDOS and released it under Microsoft branding as PC-DOS and later, MS-DOS. Show
SpecificationFAT is described by Microsoft in Microsoft Extensible Firmware Initiative FAT32 File System Specification - FAT: General Overview of On-Disk Format. Despite the name, the document includes descriptions of FAT12 and FAT16. Closely related standards are: ECMA 107 and ISO/EIC 9293, which only cover FAT12 and FAT16, and also are somewhat more restricted than the file system described by Microsoft's document. Structure
Boot RecordWhen a computer is powered on, a POST (power-on self test) is performed, and control is then transferred to the Master boot record (MBR). The MBR is present no matter what file system is in use, and contains information about how the storage device is logically partitioned. When using a FAT file system, the MBR hands off control of the computer to the Boot Record, which is the first sector on the partition. The Boot Record, which occupies a reserved area on the partition, contains executable code, in addition to information such as an OEM identifier, number of FATs, media descriptor (type of storage device), and information about the operating system to be booted. Once the Boot Record code executes, control is handed off to the operating system installed on that partition. Note that ECMA 107 does not define the boot record signature 0x55, 0xaa (or 0xaa55) FATsThe primary task of the File Alocation Tables are to keep track of the allocation status of clusters, or logical groupings of sectors, on the disk drive. There are four different possible FAT entries: allocated (along with the address of the next cluster associated with the file), unallocated, end of file, and bad sector. In order to provide redundancy in case of data corruption, two FATs, FAT1 and FAT2, are stored in the file system. FAT2 is a typically a duplicate of FAT1. However, FAT mirroring can be disabled on a FAT32 drive, thus enabling any of the FATs to become the Primary FAT. This possibly leaves FAT1 empty, which can be deceiving. Root DirectoryThe Root Directory, sometimes referred to as the Root Folder, contains an entry for each file and directory stored in the file system. This information includes the file name, starting cluster number, and file size. This information is changed whenever a file is created or subsequently modified. Root directory has a fixed size of 512 entries on a hard disk and the size on a floppy disk depends. With FAT32 it can be stored anywhere within the partition, although in previous versions it is always located immediately following the FAT region. Data AreaThe Boot Record, FATs, and Root Directory are collectively referred to as the System Area. The remaining space on the logical drive is called the Data Area, which is where files are actually stored. It should be noted that when a file is deleted by the operating system, the data stored in the Data Area remains intact until it is overwritten. ClustersIn order for FAT to manage files with satisfactory efficiency, and also to increase maximum size of the volume, it groups sectors into larger blocks referred to as clusters. A cluster is the smallest unit of disk space that can be allocated to a file, which is why clusters are often called allocation units. Each cluster can be used by one and only one file (or directory). Only the "data area" is divided into clusters, the rest of the partition is simply sectors. Cluster size is determined by the size of the disk volume and every file must be allocated an integral number of clusters. Cluster sizing has a significant impact on performance and disk utilization. Larger cluster sizes result in more wasted space because files are less likely to fill up an even number of clusters. The size of one cluster is specified in the Boot Record and can range from a single sector (512 bytes) to 128 sectors (65536 bytes). The sectors in a cluster are continuous, therefore each cluster is a continuous block of space on the disk. Note that only one file can be allocated to a cluster. Therefore if a 1KB file is placed within a 32KB cluster there are 31KB of wasted space. The formula for determining clusters in a partition is (# of Sectors in Partition) - (# of Sectors per Fat * 2) - (# of Reserved Sectors) ) / (# of Sectors per Cluster). Wasted SectorsWasted Sectors (a.k.a. partition slack) are a result of the number of data sectors not being evenly distributed by the cluster size. It's made up of unused bytes left at the end of a file. Also, if the partition as declared in the partition table is larger than what is claimed in the Boot Record the volume can be said to have wasted sectors. Small files on a hard drive are the reason for wasted space and the bigger the hard drive the more wasted space there is. FAT Entry ValuesFAT12 0x000 (Free Cluster) FAT16 0x0000 (Free Cluster) FAT32 0x?0000000 (Free Cluster) Note: FAT32 uses only 28 of 32 possible bits, the upper 4 bits should be left alone. Typically these bits are zero, and are represented above by a question mark (?). VersionsThere are multiple variants of FAT in existence, the most common ones are probably: FAT12, FAT16, and FAT32. FAT12
FAT16
FAT32FAT32 is the enhanced version of the FAT system implemented beginning with Windows 95 OSR2, Windows 98, and Windows Me. Features include:
Limitations with Windows 2000 & Windows XP
exFAT (sometimes incorrectly called FAT64)exFAT (also know as Extended File Allocation Table or exFAT) is Microsoft's latest version of FAT and works with Windows Embedded CE 6.0, Windows XP/Server 2003 (with a KB patch, Vista/Server 2008 SP 1 & Later, and Windows 7. Features include:
Although Microsoft has published some information on exFAT, there are more technical specifications available from third parties. For example, here is a detailed presentation on exFAT. Another published technical paper that goes in the internals in great detail is in the SANS Reading Room at: Reverse Engineering the Microsoft exFAT File System Comparison of FAT VersionsSee the table at http://en.wikipedia.org/wiki/File_Allocation_Table for more detailed information about the various versions of FAT. UsesDue to its low cost, mobility, and non-volatile nature, flash memory has quickly become the choice medium for storing and transferring data in consumer electronic devices. The majority of flash memory storage is formatted using the FAT file system. In addition, FAT is also frequently used in electronic devices with miniature hard drives. Examples of devices in which FAT is utilized include:
Data RecoveryRecovering directory entries from FAT filesystems as part of recovering deleted data can be accomplished by looking for entries that begin with a sigma 0xe5. When a file or directory is deleted under a FAT filesystem, the first character of its name is changed to sigma. The remainder of the directory entry information remains intact. The pointers are also changed to zero for each cluster used by the file. Recovery tools look at the FAT to find the entry for the file. The location of the starting cluster will still be in the directory file. It is not deleted or modified. The tool will go straight to that cluster and try to recover the file using the file size to determine the number of clusters to recover. Some tools will go to the starting cluster and recover the next "X" number of clusters needed for the specific file size. However, this tool is not ideal. An ideal tool will locate "X" number of available clusters. Since files are most often fragmented, this will be a more precise way to recover the file. An issue arises when two files in the same row of clusters are deleted. If the clusters are not in sequential order, the tool will automatically receive "X" number of clusters. However, because the file was fragmented, it's most likely that all the clusters obtained will not all contain data for that file. If these two deleted files are in the same row of clusters, it is highly unlikely the file can be recovered. File SlackFile slack is data that starts from the end of the file written and continues to the end of the sectors designated to the file. There are two types of file slack, RAM slack and Residual slack. RAM slack starts from the end of the file and goes to the end of that sector. Residual slack then starts at the next sector and goes to the end of the cluster allocated for the file. File slack is a helpful tool when analyzing a hard drive because the old data that is not overwritten by the new file is still in tact. Go to http://www.pcguide.com/ref/hdd/file/partSizes-c.html for examples.
The diagram above demonstrates the larger the cluster size used, the more disk space is wasted due to slack. This suggests it is better to use smaller cluster sizes whenever possible. FAT Advantages
FAT Disadvantages
FAT date and time valuesPython code to convert a FAT date and time value into a Python datetime object. import datetime def FromFatDateTime(fat_date_time): """Converts a FAT date and time into a Python datetime object. FAT date time is mainly used in DOS/Windows file formats and FAT. The FAT date and time is a 32-bit value containing two 16-bit values: * The date (lower 16-bit). * bits 0 - 4: day of month, where 1 represents the first day * bits 5 - 8: month of year, where 1 represent January * bits 9 - 15: year since 1980 * The time of day (upper 16-bit). * bits 0 - 4: seconds (in 2 second intervals) * bits 5 - 10: minutes * bits 11 - 15: hours Args: fat_date_time: The 32-bit FAT date time. Returns: A datetime object containing the date and time or None. """ day_of_month = (fat_date_time & 0x1f) month = ((fat_date_time >> 5) & 0x0f) year = (fat_date_time >> 9) & 0x7f if day_of_month < 0 or day_of_month > 30 or month < 0 or month > 11: return None fat_date_time >>= 16 seconds = (fat_date_time & 0x1f) * 2 minutes = (fat_date_time >> 5) & 0x3f hours = (fat_date_time >> 11) & 0x1f if hours > 23 or minutes > 59 or seconds > 59: return None return datetime.datetime( 1980 + year, month, day_of_month, hours, minutes, seconds) External links
Format documentation
Volume serial number
ExFAT
textFAT
ToolsexFAT
Which filename refers to the device driver that allows the OS to communicate with SCSI or ATA drives that arent related to the BIOS?sys – Device driver that allows access to SCSI or ATA drives that are not related to the BIOS. Ntoskrnl.exe – The Windows NTFS operating system kernel. It is located in the Windows\System32 folder.
When Microsoft introduced Windows 2000 it added optional built in encryption to NTFS called ___?The company updated NTFS in Windows 2000 to include file system-level encryption, which Microsoft refers to as EFS, or the Encrypting File System. EFS uses symmetric multikey encryption to protect file system contents.
What term refers to the number of bits in one square inch of a disk platter?Areal Density. The number of bits of data that can be recorded onto the surface of a disk or platter usually measured in square inches. The areal density is calculated by multiplying the bit density (BPI - Bits Per Inch) by the track density (TPI - Tracks Per Inch).
Which acronym refers to the file system that was introduced when Microsoft created Windows NT and that remains the main file system in Windows 10?NT file system (NTFS), which is also sometimes called the New Technology File System, is a process that the Windows NT operating system uses for storing, organizing, and finding files on a hard disk efficiently. NTFS was first introduced in 1993, as apart of the Windows NT 3.1 release.
|