1. How is the TF card space allocated?
The following is an example of a 4GB TF card, which is analyzed using the Winhex tool and its spatial distribution is as follows:
FAT32 the directory as a file to manage, so there is no separate directory area, all the file directory entries are in the data area.
2. Boot sector (DBR)
DBR (DOS boot record,dos boot record), located in cylinder 0, head 1, Sector 1, that is, the logical sector 0;
DBR includes:
• One boot program: DOS boot program to complete the location and loading of DOS system files (io.sys,msdos.sys)
• A BPB:BPB used to describe the disk information of this DOS partition, such as: the starting sector of this partition, the end sector, etc.
Note: Search for DBR Flags:
FAT16 Dbr:eb 3C 90, DBR without backup
FAT32 DBR:EB 58 90, there is a backup of DBR, usually in the 6th sector of the partition
NTFS Dbr:eb 52 90, there is a backup of DBR, usually in the last sector of the partition
2.1 DBR Composition
| Offset amount |
Length/byte |
Part |
| 00H |
3 |
Jump Instructions |
| 13) |
8 |
Operating system vendor ID and version number |
| 08H |
80 |
Partition parameter table (also known as BPB), which holds the necessary parameters for read and write operations on the partition |
| 5AH |
420 |
DOS boot code, which is responsible for the DOS boot files Io.sys, MSDOS. SYS loaded into memory |
| FEH |
2 |
End Glyph "55AA" |
2.2 BPB (BIOS Parameter Block) composition
3. FAT (file Allocation table) partition tables
• cluster (Cluster)
is the unit of measure allocation that the file data area is divided into with an area of equal size for the disk file.
• file allocation table
is a special file located on a disk 0 sector that contains information such as the size of the file on disk and the location of the cluster where the file resides.
• the first cluster number of the file
stored in FDT (root directory) registrations, followed by cluster numbers in fat.
Fat tables identify the usage of space in a partition in clusters (4 bytes per identity). It looks like this:
The FAT first 2 clusters are reserved clusters (cluster 0 and cluster 1) and are not assigned to file usage, and their content meanings are as follows:
FAT16:F8 FF FF
FAT32:F8 FF FF 0F FF FF FF
A FAT table entry value indicates a cluster number occupied by the file and indicates the location of the next cluster number.
The Fat table records the usage of each cluster in sequential order, and is a kind of bit graph method. The use of each cluster is filled with 32-bit binary, the non-allocated cluster corresponding position is written 0; the corresponding location of the broken cluster is filled with a specific value, and the allocated cluster is populated with a value other than 0, specifically: If the cluster is the last cluster of the file, the value entered is ffffff0fh (that is, 0X0FFFFFFF). If the cluster is not the last cluster in the file, the value that is filled is the cluster number of the next cluster that the file occupies, so that the clusters that occupy the file are formed into a cluster chain and stored in the Fat table. 0000000H, 00000001H two cluster number is not used, its corresponding two DWORD position (8 bytes at the beginning of the Fat table) is used to hold the disk media type number.
The size of the fat table is determined by the number of clusters in the data area of the logical disk, taking the entire number of sectors.
When the file system is created, that is, when it is formatted, the space allocated to the fat area is emptied, and a specific value is written to the No. 0 and 1th table entries in FAT1 and FAT2. Because the file system is created at the same time, the root directory is also created, that is, the root directory is allocated a cluster space, usually 2nd cluster, so the number 2nd corresponding to the 2nd Fat table entry will also be written to a closing tag, as shown in.
When a cluster is already allocated, the FAT table entry value within its corresponding FAT table entry is the cluster number of the next storage location for the file. If the file ends in the cluster, a file end tag is recorded in its fat table entry, and for FAT32, the Fat table entry value for the end of the file is 0x0fffffff.
If a cluster has bad sectors, the entire cluster is marked as a bad cluster with the FAT table entry value 0XFFFFFF7, which is no longer used, and the bad cluster tag is recorded in its corresponding fat table entry.
When you create a new file in the file system, if the newly created file occupies only one cluster, the FAT table entry for the cluster to which it is allocated will be written to the closing tag. If a newly created file consumes more than one cluster, it writes the cluster number of the next cluster assigned to it in the Fat table entry for each cluster it occupies, and writes the closing tag in the fat representation of the last cluster.
When you create a new directory, only one cluster of space is allocated for it, and the closing tag is written to the corresponding fat table entry. When the directory grows beyond the size of a cluster, it will continue to be assigned a cluster in the free space and a fat bracelet in the fat table to describe the cluster it occupies.
When working with files or directories, their corresponding fat table entries are emptied and set to 0 to indicate that their corresponding clusters are in an unassigned state.
4. FDT (file directory table) files directory table
The File directory table (FDT) is comprised of several 32-byte table entries. It records the following contents of each file (directory): • file name • Extension • Whether long file names are supported • Starting unit (that is, the starting cluster number, which is most important) • Properties of the file • Size • Creation date, etc. When a disk is formatted with the Format command, a root directory FDT has been established for the entire disk. All files and their subdirectories in the root directory have a directory entry or directory entry in the root directory table (FDT). Each catalog entry occupies 32 bytes and is divided into 8 regions, providing information about the file or subdirectory. It is described in more detail as shown in: 0--7 Bytes: The file is being cleared. 8--10 Bytes: File extension. • 11 bytes: file attributes, as defined by bits, up to two bits reserved unused, 0 to 5 bits are read-only, hidden bit, System bit, volume label, subdirectory bit, archive bit.
12--13: Byte only long file name directory entry, used to store its corresponding short file name directory entries of the filename section checksum, and so on.
14--15: Byte 24-bit binary file settling time, where the high 5 bits are hours and the second 6 bits are minutes.
16--17 Bytes: 16-bit binary file establishment date, where the high 7 bits are the year values relative to 1980, the second 4 bits are the month, and the 5 bits are the month dates.
18--19 Bytes: 16-bit binary file The latest access date, defined with (6).
The high 16 bits of the 20--21 byte starting cluster number.
22--23 byte 16-bit binary file The latest modification time, where the high 5 bits are hours, the second 6 bits are minutes, and the last 5 bits are twice times the number of seconds.
24--25 byte 16-bit binary file The latest modification date, defined with (6).
The low 16 bits of the 26--27 byte starting cluster number.
28--31 byte 32-bit file byte length. The format is little Endian, that is, the high-order byte is at a higher address.
4.1 Changes after deleting a file • In the FAT file system, when the file is deleted, the operating system finds the corresponding directory file table that modifies the first byte to the "E5" flag
• Also, empty the corresponding items of the FAT file allocation table for use by other programs
• The data of the file is not overwritten, but is actually present, but is invalid for the operating system garbage data
• When a new file needs to be stored, the new data can be written directly to the original data location 4.2 root (root) the root area is no longer a fixed area, fixed size, and can be considered as part of the data area. Because the root directory has been changed to the root directory, the same management method as the subdirectory file, generally starting from the 2nd cluster, the size is increased as needed, so the number of files in the root directory is no longer limited by up to 512. Although in principle FAT32 allows the root directory to be located anywhere the data goes, it is usually located in cluster 2nd.
4.2.1 Locating the root directory in the FAT32 file system, it is not easy to find the location of the first cluster (that is, cluster 2nd), which is the beginning of the data area, because it is not at the beginning of the file system, but in the data area. In front of the data area are reserved and fat areas, both of which are not managed using fat tables. As a result, the previous regions of the data area can use only sector addresses (logical volume addresses), and cluster addresses cannot be used.
To locate the data starting point of a FAT32 file system, you can calculate it by the relevant parameters of the boot sector. 1) a reserved sector is obtained from the offset 0x0e~0x0f byte of the boot sector. 2) Get the number of fat tables from offset 0x10 bytes. 3) The number of size sectors per fat table is obtained from the offset 0x24~0x27 bytes. 4) Use the following formula to calculate:
Number of reserved sectors + number of sectors per FAT table size Xfat table = Data area start Sector area code
To calculate the sector area code for other known cluster numbers, find the number of sectors per cluster size at the offset 0x0d byte of the boot sector, and use the following formula to calculate:
A cluster start sector area code = Number of reserved sectors + number of sectors per FAT Table Xfat table + (the cluster number-2) x number of sectors per cluster
4.2.2 root directory analysis The root directory is created when the file system is established, and is intended to store directory entries for directories (also called folders) or files. Each directory entry has a size of 32 bytes.
When the file system has just been created, no data is stored in the root directory, the file system simply allocates a cluster of space for the root directory (usually cluster 2nd), writes the end tag to the corresponding FAT table entry for the cluster, indicating that the cluster has been allocated for use. At this point, the space allocated for the root directory has no content. However, if a volume label is set when the file system is created, a volume label directory entry is established for it under the root directory, which occupies the first directory entry location in the root directory.
Either the root directory or the directory entry under a subdirectory has the following basic features:
1) The cluster number of the first cluster assigned to the file or subdirectory is recorded in its catalog entry, and other subsequent clusters are tracked by the fat bracelet in the Fat table.
2) In addition to the record subdirectory or the file start cluster, it also records information such as its name, size (subdirectory no size), time value, and so on.
3) Each subdirectory or file has a long file name directory entry in addition to a short directory entry.
4) The short file name directory entry is fixed at 32 bytes, and the long file name entries occupy 1 or several 32 bytes as required.
5) for the same subdirectory or file, its long file name directory entry is placed before its short name directory entry, and if the long file name directory entry occupies more than 32 bytes, it is placed in reverse order before the segment file name directory entry. 4.3 File location in DBR There is a record root directory location information (2CH: The starting cluster number of the root directory of the disk), by querying the root file table FDT, find the corresponding file and directory information, in FDT records the name of the file, properties, creation time, modification time information, also recorded the file's starting cluster number, Information such as the actual size of the file. With the starting cluster number of the root directory, you can calculate the starting sector code for this cluster: A cluster start sector area code = Number of reserved sectors + number of sectors per fat table Xfat + (the cluster number-2) x number of sectors per cluster according to the above formula, you can calculate: root directory starting Sector code = 0x24 + 7566 (0x1d8e) x 2 + (2-2) x 8 = 15168 in DBR, the starting cluster number of the root directory is as follows:
FAT32 file system--for TF card
