Windows 95 osr2 and Windows 98 start to support FAT32
File System, which is an enhancement to the fat16 file system of early dos --
The file allocation table fat is expanded from 16 bits to 32 bits, so it is called the FAT32 file system. More than 512 of A Logical Disk (one partition of a hard disk)
This format is used when the node is used to store data more efficiently and reduce the waste of hard disk space. Generally, the program runs faster and fewer computer system resources are used, therefore, it is an extremely effective system that uses large-capacity hard disks to store files. For Windows
FAT32 under 98
The file system has carried out an analysis experiment, which is not changed much in general with the fat16 file system. The changes are described as follows: (1) FAT32
The file system divides the space of a logical disk into three parts: boot, fat, and data ). The boot area and File Allocation Table area are also called the system area. (2) The Boot area starts from the first sector and uses three sectors to save important parameters and boot records, such as the number of bytes per sector of the Logical Disk and the number of sectors corresponding to each cluster. After
There are also several reserved sectors. The boot area of the fat16 file system only occupies one sector without retaining the sector.
(3) Two identical file allocation tables are saved in the file allocation table area, because the storage space (cluster chain) occupied by files and the management of free space are implemented through fat,
Fat is so important that it saves two so that when the first corruption occurs, there is a second available. The file system divides and manages the storage space of the Data zone by cluster.
The basic unit of recycling, that is, a file always occupies several whole clusters, and the remaining space of the last cluster used by the file will not be used, but will be wasted.
Statistically speaking, each file wastes 0.5 clusters of space on average. The larger the cluster, the more space-time waste of stored files, and the lower the utilization rate. Therefore, the size of the cluster determines the disk data.
Zone utilization. Fat16 system cluster numbers are represented by 16-bit binary numbers, ranging from 0002h to ffefh Available Cluster numbers (defined separately from fff0h to ffffh, used to indicate Bad Clusters and end clusters of files ),
Each Logical Disk can have up to 65518 ffedh clusters. The FAT32 system cluster number is represented by a 32-bit binary number, which ranges from H to fffffeffh.
. The fat table records the usage of each cluster on the disk in sequence.
Use 32-bit binary codes for the usage of each cluster. Do not enter zero in the corresponding location of the unallocated cluster. Enter a specific value in the corresponding location of the bad cluster. Enter a non-zero value in the corresponding location of the allocated cluster.
If the cluster is the last cluster of the file, the value is ffffff0fh. If the cluster is not the last cluster of the file, the value is the cluster number of the next cluster occupied by the file.
As shown in the following figure, each cluster occupied by the file is a cluster chain and saved in the fat table. The cluster numbers 0000000 H and H are not used, and their corresponding DWORD locations (8 at the beginning of the fat table)
(Bytes) used to store the media type numbers of the disk. The size of the fat table is determined by the number of clusters in the Data zone of the Logical Disk. An integer sector is used.
(4) a cluster of FAT32 systems corresponds to eight adjacent logical sectors. Theoretically, the maximum Logical Disk capacity managed by this method is 16 Tb (16384 GB). When the capacity is larger than 16 TB,
You can use a cluster to correspond to 16 sectors, and so on. When the Logical Disk capacity of the fat16 system is between MB and MB, a cluster corresponds to eight sectors. When the disk capacity is between MB and MB
It corresponds to 16 sectors. When the capacity is between MB and 1 GB, a cluster corresponds to 32 sectors. When the capacity is between 1 GB and 2 GB, a cluster corresponds to 32 sectors. The portion exceeding 2 GB cannot be used. Display
However, for logical disks with a capacity greater than MB, FAT32 clusters are much smaller than fat16 clusters, greatly reducing the waste of space.
However, for disks with a capacity less than MB, the use of FAT32, although a cluster of 8 sectors, compared to the use of fat16 clusters of 16 sectors, the cluster is reduced, but the FAT32 fat table is large, occupying
There is a lot of space, and the total data zone is reduced. The two are in conflict, and the actual space cannot be increased. Therefore, Microsoft recommends that you do not use FAT32 for logical disks smaller than MB.
In addition, for users who use the fat16 file system, do not set the partition (Logical Disk) Capacity to the lower limit of a certain range during hard disk partitioning. For example, set a Logical Disk
When the capacity is set to 1100 m (slightly greater than 1024 m), the effective storage capacity is usually smaller than m, because its cluster is twice as large as a waste of space. Also, use fdisk
When the capacity is specified for a partition, the definition of 1 MB is different (the standard binary 1 MB is 1048576b, some systems understand 1 MB as B, kb, etc.), and each partition
The actual allocated capacity may be slightly larger than the specified capacity due to factors such as starting from the new track.
(5) the root directory area is no longer a fixed area or a fixed size. It can be seen as a part of the data area. Because the root directory has been changed to the root directory file
The same management method is usually used from the second cluster, and the size increases as needed. Therefore, the maximum number of files in the root directory is no longer limited by 512. Fat16 File System
The root directory is a fixed area and a fixed size. It is the 32 sectors following the fat area. A maximum of 512 directory items can be saved as part of the system area.
(6) There are many changes to directory items in the directory area. A directory item still occupies 32 bytes. It can be a file directory item, sub-directory item, or volume label item (only available in directories), deleted directory items,
Long file name directory items. In the directory items, the unused 10 bytes are reserved under DOS. The definition of all 32 bytes is as follows:
(1) 0 7-Byte File Name
(1) 0 -- the name of the 7-byte file.
(2) 8-10 bytes file extension.
(3)
11-byte file attribute, defined by binary bits. The maximum two bits are retained. The values 0 to 5 are read-only bits, hidden bits, system bits, Volume bits, subdirectory bits, and archive bits.
(4)
11-13 bytes are used only for long file name directory items, and are used to store the file name byte checksum of their corresponding short file name directory items.
(5)
The creation time of a 13-15-byte 24-bit binary file, in which the 5-bit high is the hour, and the 6-bit time is the minute.
(6)
16-17 bytes 16-bit binary file creation date, in which the High 7-bit value is relative to the Year Value of 1980, the next 4-bit is the month, and the last 5-bit is the month date.
(7) The latest access date of the 18--19 byte 16-bit binary file, defined as (6 ). (8)
The 16-bit high of the starting cluster number of 20--21 bytes. (9)
The latest modification time of the 22--23 byte 16-bit binary file. The 5-bit high is the hour, the 6-bit is the minute, and the Second Five-bit is the second.
(10) The latest modification date of the 24--25-byte 16-bit binary file, defined as (6 ).
(11) The 16-bit lower of the starting cluster number of 26--27 bytes.
(12) 28-31 bytes 32-bit file length. Items (4) to (8) are defined in the future. For sub-directory items, its (12) is zero; the first byte value of the deleted directory item is e5h. You can use FAT32 with a long file name
In the system, the file directory item stores the short file name of the file. The long file name is saved by several directory items of the long file name. The long file name directory item is placed in the descending order before the short directory item of the file, all are saved using double-byte internal codes. Each item can store up to 13 characters in the internal code. The first byte indicates the maximum number of long file names, 11 bytes are generally 0fh, and 12 bytes indicate the type, the 13-byte is the checksum, And the 26--27 byte is zero. (7) earlier versions of Windows
It is not compatible with DOS and FAT32, and cannot identify FAT32 partitions. Some programs also rely on fat16.
File System, not FAT32
The drive works together. To convert the hard disk to FAT32, you cannot use dual boot to run previous versions of Windows (Windows
95 [version 4.00.950], Windows NT 3.x, Windows NT 4.0, and Windows
3. X ). Hard Disk data recovery knowledge data recovery has always been a concern because your computer data is threatened by viruses, malicious code, hackers, and misoperations every day! So how can we restore your data? I hope this article will help you!
I. Theory
It is not easy to learn data recovery in depth. To become a data recovery expert without profound theoretical knowledge, you must have a good understanding of disk compaction.
Logic Structure. Let's take a look at the theoretical knowledge we need to learn.
When we access a file, have you ever thought about how the operating system operates the file? How are these files stored on the disk? First look at the hard disk
Before introducing the general structure of the hard disk, it is necessary to introduce the parameters of the hard disk. The hard disk is accessed by the head (heads), cylinders (cylinders), and sectors (sectors ).
Yes. Among them: the number of magnetic heads (heads) indicates that the hard disk has a total of several heads, that is, there are several disks,
The maximum value is 255 (stored in 8 binary bits), and the number of cylinders)
Indicates the number of tracks on each disk of the hard disk. the maximum size is 1023 (10 binary bits are used for storage );
Number of sectors (sectors) indicates that each track has several sectors. The maximum value is 63 (6
Binary bit storage ).
Each slice is generally 512 bytes. If you have learned the assembly language, you may think that the CH is the track number in the input parameter for 13 h bios interruption. The value of CH is 0 h ~ Feh (up to 255 channels). The middle and low 6 bits in CL are fan area numbers, and their values are 1 h ~ 3fh (63 sectors at most), DH is the low position of the head number, and the high 2 bits in CL are the high positions of the head number. That is to say, the head number is expressed by a maximum of 10 bits, (1111111111) 2 = (1023) 10, that is, up to 1024 magnetic heads can be expressed. Please remember that these will be used in our future studies. We can see that the maximum disk capacity we can access based on this access method is:
255*1023*63*512 bytes = 8414461440/1048576 = 8024.66 m
There is only about 8 GB space, because the disk was still small in the early days. Think about the joy of having a m hard disk! It seems that scientists thought the 1 K memory was already very high.
As a result, computer users have to worry about configuring the memory in DOS for a long time. Now, you must have a hard disk larger than 8 GB. Thanks
New Hard Disk access technology-extended int13h technology. Uses linear addressing to access hard disks,
So we broke the 8g limit,
We have also added support for removable media (such as removable hard disks) because we are talking about data recovery rather than programming. I will not detail the extended int13h technology here. The general structure of Hard Disk Data (based on the fat structure) is as follows:
1. Master Boot Sector (occupies one sector)
2. Boot Sector of the first partition (occupying one sector)
3. fat1 of the first partition (the occupied space is determined by the disk size and fat type)
4. fat2 of the first partition (the occupied space is determined by the disk size and fat type)
5. root directory of the first partition
5. the root directory of the first partition
6. The first partition data zone (used to store data of various files)
7. Expand the Partition Table (occupying one sector)
8. Boot Sector in the second partition (occupying one sector)
9. fat1 of the second partition (the occupied space is determined by the disk size and fat type)
10. fat2 of the second partition (the occupied space is determined by the disk size and fat type)
11. root directory of the second partition
12. The second partition data zone (used to store data of various files)
13. extended partition table
...
Note: When your hard disk does not have extended partitions, you will not have extended partition tables; when you only have one hard disk partition, your hard disk structure will be 6.
(1) Structure of the Master Boot Sector:
It is the first sector of the hard disk.
Record (MBR), hard disk partition table (disk partition)
Table (DPT) and end ID. The structure is as follows: 1. The offset is 0 h ~ 1bdh
Main Bootstrap program (446 bytes, but it may not actually contain so many bytes)
2. 1beh ~ 1fdh
Hard Disk Partition Table (64 bytes. Each partition item occupies 16 bytes and can accommodate up to 4 partition items)
3. 1feh ~ offset ~ 1ffh end mark (2 bytes, end mark, total 55 h
AAH) I will not analyze the main Bootstrap program here. It should be noted that there are some error messages in the main Bootstrap program, some Boot viruses often overwrite this information to embed themselves into the main boot program, and change the first few bytes of the Main Boot Program to a jump command, by observing the changes in the main boot program, we can often see whether our computer has a boot virus. Once an exception is found, we can use the fdisk/MBR command to overwrite the original MBR. The two bytes of the end identifier are always 55 H.
Aah, this ID is only used to determine whether this sector is a valid primary boot sector. If the primary boot program finds that this end ID is not found, the operating system is lost and "missing" is displayed.
Operating System ". Hard Disk Partition Table:
Offset from 1beh ~ The 64 bytes of 1fdh are stored in the hard disk partition table, which contains a maximum of 4 partition items. Each partition item consists of 16 bytes. Its structure is as follows:
1. 1beh ~ 1cdh partition Item 1
2. 1ceh ~ 1ddh partition Item 2
3. 1dbh ~ 1edh partition Item 3
4. 1efh ~ 1fdh partition Item 4
Note: records on unused partition items are always 16 hexadecimal codes 00 h
Let's take a look at the detailed meaning of each partition item. Assume that the 16 bytes occupied by one partition are marked as 00h ~ 0fh. Its structure is as follows:
00 h
Bootstrap Identifier byte. The value can only be h or 80 h. If it is H, it indicates that the partition is not bootable. If it is 80 h, it indicates that the partition can be used for bootstrap. In many
Magic and other software use this principle to implement multi-OS boot. After learning about this principle, you can also write your own multi-OS boot program.
01 H partition start head No. 02 h
Its 2-bit height is the high position of the starting shard number, and the 6-bit base is the 03 h
04 H lower position of the Start cylindrical Number of the partition
Partition system flag. If this value is H, it indicates that this partition is an unrecognized system. If it is H, this partition is fat16; if it is 05h or 0fh, this partition is an extended partition; 0 B
The partition is FAT32, and 83h indicates that the partition is Linux,
When the value is 07, the partition is NTFS, and so on. Some disk software such as pqmagic stores the content of this Byte in the hidden partition operation and changes it to 00 H.
05 h partition end head 06 h
Its 2-bit height is the high position of the ending cylindrical Number of the partition, and the 6-bit base is the 07 h
Low Position 08h ~ 0bh
The four bytes are the slice address of the partition in linear addressing mode. When the partition size is greater than 8 GB, the extended int13h is addressable through this information. We can find that the maximum accessible space for addressing in this mode is: ffffffffh fan * 512b/
Fan = 2048 GB, that is to say, we can use the extended int13h to have a maximum access space of 2048 GB. This number is very big for us now, but no one can imagine the rapid development of computers, how can we break through this restriction? No one knows now. Note: These four bytes
It is arranged from high to low! For example, for the first partition item in my partition table, the 4-byte content is "3fh 00 h
00 h
00 H ", it indicates that the partition starts from, that is, 63 linear addresses (linear addresses mark the first hard disk as 0 h)
0ch ~ 0fh
These four bytes are the size of the partition (total number of sectors) in units. These four bytes are also arranged from the high to the low!
(2) Boot Sector
Sector) structure: when the main boot program finds a partition with a boot ID of 80 h, it will read the Boot Sector of the partition into the memory address of 0000: 7c00
And give the control to the boot program in the boot sector. Let's take a look at some of the points that need to be understood:
1. 0h ~ 02 h a jump command pointing to the next Bootstrap 2, 03h ~ 0ah
Vendor name and System Version 3, 0bh ~ 0ch number of bytes per row, generally 512 bytes
4. 0dh
The number of sectors per cluster (we will introduce the concept of a cluster in detail later). For a FAT32 disk, this byte is generally 08 h, which is 8 h * 512b = 4 K for each cluster.
5. 0eh ~ Number of 0fh reserved sectors 6, 10 h Number of disk fat, usually 2
7. 11 h ~ 12 h
For a fat16 disk, this is the maximum directory of the root directory. For a FAT32 disk, this value is always "00 h 00 H"
8. 13 H ~ 14 h
For a floppy disk or an earlier hard disk, this is the total number of partitions. For a hard disk, this value is generally "00 h 00 H"
9. 15 h media description. For 1.44 floppy disk, the length is "f0h", and for hard disk, the length is "f8h"
10, 16 h ~ 17 h
For a floppy disk or an earlier small hard disk, this value is generally set to "00 H" for the number of sectors occupied by each fat.
00 H "11, 18h ~ 19 h number of sectors, usually "3fh 00 H", that is, each with 63 sectors
12. 1ah ~ 1bh Magnetic Head, generally "FFH 00 H", that is, each cylinder has 255 head 13, 1ch ~ 1fh
Number of hidden sectors: 14, 20 h ~ 23 h for a large hard disk, this stores the number of sectors occupied by the partition.
15, 24 h ~ 27 h for a large hard disk, each fat occupies 16 sectors, 40 h
Here is the disk BIOS information. The first hard disk is "80 h", and the floppy disk is generally "00 H" 17, 47h ~ 51 H
The volume label set by the user. If there is no volume label, it is usually the string "No Name" 18, 52h ~ 59 h
File System. For FAT32 file systems, "FAT32" 19, 1feh ~ 1ffh
End ID, which is the same as the end ID of the Master Boot area mentioned above. It is "55 h aah"
The above are some information about the boot sector. We can obtain some useful information above, we can also imagine why we can right-click a partition and view partition information, such as the partition size and file system, in the partition attributes, you can also directly call these parameters.
(3) Disk File Allocation Table (FAT)
Before introducing fat, we should first understand the concept of a cluster. A cluster is a file data area divided into areas of the same size for Disk File metering and distribution orders.
Bit. A cluster may have 1, 2, 4, 8, 16, 32, 64, or 128 (must be a power of 2) sectors, however, for a disk system, the value is always certain, for example, in fat16
Each cluster is generally 32 K (64 fans), and FAT32 is generally 4 K (8 fans ).
To understand why the operating system needs to manage disks in clusters, we still need to learn fat. in FAT32, some unused sectors are retained after the boot area of the system, followed by one
Fat table starting with f8h FFH 0fh (for fat16, It is f8h
Each fat item occupies 32 bits (4 bytes) and each fat item of fat16 occupies 16 bits (2 bytes). Different fat values have different meanings:
Description of the table item value of FAT32 of fat16
0000 h 00000000 H unused empty Clusters
001h ~ Fefh 0001h ~ Ffefh 00000001h ~ 0 fffffefh file used cluster
Ff0h ~ Ff6h fff0h ~ Fff6h 0ffff0h ~ 0ffffff6h system reserved Cluster
Ff7h fff7h 0ffffff7h bad Cluster
Fff8h ~ Fffh fff8h ~ Ffffh 0ffffff8h ~ 0 fffffffh file's last cluster
Note: The hexadecimal codes in the fat table are always arranged from high to bottom.
Let's take a look at how the system uses the fat table to manage and access files. When creating a new file, the system scans fat one by one, skips the allocated cluster, and distributes the cluster
The cluster number is placed in the file directory of the file as the starting cluster number of the file (we will discuss the file directory items later ), if the file size only needs one cluster
If you can put it down, the mark of the last cluster of the file (generally FFH) will be put in the fat item corresponding to the cluster.
FFH
F0h, that is, its value is 0 fffffh). If the file size cannot fit into a cluster, the system will continue to look for unused clusters in the fat table, after finding it, write the cluster ID of the cluster to the fat item corresponding to the previous cluster. If the data of this file can be saved, the system will mark the last cluster in the fat corresponding to this cluster, otherwise it will continue to find an empty cluster ......
That is to say, fat corresponds to a cluster. For fat of FAT32, each 4 bytes is a fat item (for fat of fat16, each 2 bytes is a fat item ), from 0 ~ N fat
Items correspond to 0 ~ N clusters. When we access files, we always first access the directory items of the files, find the first cluster number, then find the fat item corresponding to the cluster number, and find the next
Cluster ID of the Cluster. Find the cluster ID of the next cluster in the fat item of the next cluster ...... it is not until the last cluster of the file is found in the fat item that we can find the file.
. (Of course, the file may end in the fat corresponding to the first cluster.) This forms a chain, which we call a disk cluster chain.
A brief introduction is given to the fat12 system. fat12 is only used for floppy disks. Because each fat occupies 12 bits, every 2 bytes contains 3 fat items. Let's take a look at the fat12 system looking for clusters.
Chain Process: Convert the 10-digit cluster number * 1.5 to an integer. The value is relative shift of fat, where the cluster number of the next cluster is stored, and so on.
One question: how many slice does each cluster occupy? Number of clusters occupied by files:
Number of clusters occupied by files = [file length/space occupied by each cluster] rounded up + 1
Files cannot be fully filled when they are stored in the last cluster. If they are not fully filled, they will be wasted (as if we cannot call every phone call to reach x minutes and 59.99 seconds, even if you
The call time is X minutes and 1 second. You also need to pay the phone fee of x + 1 points.) We can calculate the disk space waste of your fat system:
Wasted space size = number of files/2 * number of bytes per cluster (on average, half of the cluster space is wasted for each file)
In this way, it seems that the smaller the cluster, the smaller the waste space, but there is a conflict that the smaller the cluster, the larger the space used by the fat, and the smaller the cluster, the longer the cluster chain is, the more
Time will be extended, which is a waste of resources. Therefore, the size of the cluster should be based on the principle of improving the file access time and making full use of disk space.
(3) structure of directory items
After 2nd fat tables (the system usually has two identical fat tables), we can find the root directory of the partition and there are many directory items on it (Note: The Directory items are not the root directory.
Yes). Let's first review the meaning of each byte in the fat16 directory item:
Consists of 32 bytes:
00h ~ The name of the 07 h file, where 00h is the following values, has some specific meanings:
00 h table items are empty table items
E5h File deleted
05 h the actual value of this byte is e5h
08h ~ 0ah File Extension
The attribute bytes of the 0bh file are as follows:
B7 ~ B6 unused
B5 Archive Bit
B4 sub-directory (indicating that the file is a directory or a folder)
B3 scale (the scale is also interpreted as a special file)
B2 System File
B1 hide files
B0 read-only file
0ch ~ 15 h fat16 system reserved unused
16 h ~ The last modification time of the 17 h system, where:
16-byte 0 ~ 4-digit is an increment of 2 seconds.
5-16 bytes ~ 7-bit and 17-H bytes 0 ~ Two digits are minutes.
3 ~ of 17 h bytes ~ 7 digits are hours
18h ~ The last modification date of the 19 h file, where:
18 h bytes 0 ~ The four digits are the day number.
18 h bytes 5 ~ 7-bit and 19-H-byte 0-bit are months
1 ~ of the 19h bytes ~ 7 digits: Year, 0 ~ 119 represents 1980 ~ 2099
1ah ~ The starting cluster number of the 1bh file (we have already introduced it)
1ch ~ 1 FH file length (in bytes)
We know that the file name used in the fat16 system has some drawbacks. For example, the file name can only contain 8 characters (or 4 Chinese characters) at most, and the extension can contain 3 characters at most, case-insensitive, not
Can use some special characters. These problems have been solved in the FAT32 system. Let's take a look at how the FAT32 system solves the problem of long file names. Assume that there is one
The file name is abcdefghijklmnopqrstuvwxyz111111.txt. Therefore, the file occupies four 32-byte directory items in the disk directory, three of which are
The record is used to describe long file names. One directory item is used to be compatible with the old fat system. Let's take a look at the first three directory items used to describe long file names in the example:
43 h 31 h 00 h 31 h 00 h 31 h 00 h 31 h 00 h 31 h 00 h 0fh 00 h 27 h 31 h 00 h
2EH 00 h 74 h 00 h 78 h 00 h 74 h 00 h 00 h 00 h 00 h 00 h FFH
02 h 6eh 00 h 6fh 00 h 70 h 00 h 71 h 00 h 72 h 00 h 0fh 00 h 27 h 73 h 00 h
74 h 00 h 75 h 00 h 76 h 00 h 77 h 00 h 78 h 00 h 00 h 00 h 79 h 00 h 7ah 00 h
01 H 61 h 00 H 62 h 00 h 63 h 00 h 64 h 00 h 65 h 00 h 0fh 00 h 27 h 66 h 00 h
67 h 00 H 68 h 00 h 69 h 00 h 6ah 00 h 6bh 00 h 00 h 00 h 6ch 00 h 6DH 00 h
It is not difficult to see some rules in the directory items that describe long file names:
Among the 32 bytes of each directory item, (1), 0 h offset: represents the serial number of the long file Description Directory item, if the value of 4-bit-height is 0100, this indicates that this item is the last directory item.
The four digits indicate the serial number of the Directory item of the long file name. If this long File Name Description Directory only uses one directory item, the value is 41 h. If this value is e5h, the file has been deleted;
(2) offset 0bh ~ 0ch: the total value is 0fh.
00 h; (3), offset 0d: the label of the long file directory item, this value is always the same for different directories in the same long file directory (for example, the value of the three directories in this example is 27 h); (4), 1ah ~ offset ~ 1bh: the total value is 00 H.
00 h; (5) offset from 01h ~ 1fh skips the byte mentioned in the first four items and is always a file name.
The ASCII code is arranged by H. If the file name's ASCII code is not completed in a directory item, it is connected to the next directory item (in fact, these directory items are arranged from high to low) write again at the same position. If it has been written, the system will write 00 h after the last acⅱ code, and write up to 3 00 H. If it is written after 3 h, the directory item has its spare space
The system will write all these locations into FFH.
At the same time, the FAT32 system also has a directory item similar to fat16 (followed by a directory with a long file name), which also occupies 32 bytes:
00h ~ 07 h file name
08h ~ 0ah File Extension
0bh file attributes
0ch reserved unused
0eh ~ 0fh File Creation Time
10 h ~ 11 h last file access date
12 h ~ 13 H file creation date
14h ~ 16-bit high of the starting cluster number of the 15 h file
16 h ~ The last modification time of the 17 h system, where:
16-byte 0 ~ 4-digit is an increment of 2 seconds.
5-16 bytes ~ 7-bit and 17-H bytes 0 ~ Two digits are minutes.
3 ~ of 17 h bytes ~ 7 digits are hours
18h ~ The last modification date of the 19 h file, where:
18 h bytes 0 ~ The four digits are the day number.
18 h bytes 5 ~ 7-bit and 19-H-byte 0-bit are months
1 ~ of the 19h bytes ~ 7 digits: Year, 0 ~ 119 represents 1980 ~ 2099
1ah ~ The starting cluster number of the 1bh file is 16 bits
1ch ~ 1 FH file length (in bytes)
Note: The file name is a DOS-compatible file name. For example, in the above example, the file name under DOS is abcdef ~ 1. txt; its first byte meaning is the same as that of fat16 system; File Attribute byte meaning is the same
The last access date and file creation time date are added to the FAT32 system. The calculation principle is the same as the last modification time and date in fat16.
Items (4) to (8) are defined in the future. For sub-directory items, its (12) is zero; the first byte value of the deleted directory item is e5h. You can use FAT32 with a long file name
In the system, the file directory item stores the short file name of the file. The long file name is saved by several directory items of the long file name. The long file name directory item is placed before the short directory item of the file in reverse order, all
The two-byte internal code is used for storage. Each item can store up to 13 characters in the internal code. The first byte indicates the maximum number of long file names, 11 bytes are generally 0fh, and 12 bytes indicate the type, 13 characters
The Section is a Checksum, And the bytes 26--27 are zero.
(4) extended partition table
We have learned that the 04 H offset of the partition table in the primary boot sector is the partition system identifier. If the value is 05h or 0fh, it indicates that the partition is an extended partition. In fact, it is not a real partition.
In the sense of partition items, this partition item only points to an extended partition table. This is done to solve the problem that only four partition items can exist in the partition table, and the extended partition table is also extended from
The sector offset of the partition table is 1beh ~ Offset 1fd, this sector 0 h ~ 1bdh is generally 1beh 00 h, and the end sign is also 55 H.
Aah ends. Similarly, a partition item pointing to the next extended partition table may exist in the extended partition table.
