Parse FAT16 file system and fat16 File

Parse FAT16 file system and fat16 File
The information of the boot sector is as follows:

 

1. offset address 00 H, length 3, content: EB 3C 90 jump instruction.

2. offset address 03 H, length 8, content: 4D 53 44 4F 53 35 2E 30 is the manufacturer's logo and OS version number, here is MSDOS5.0.

3. offset address 0BH, length 2, content: 00 02. Note the data layout here. The high address is in the high byte, and the low address is in the low byte format (the data is organized in the small-end format). Therefore, the data size should be 0200, or 512. Indicates that each sector of the disk has 512 bytes. Some may be 1024, 2048, or 4096.

4. offset address 0DH, length 1, content: 01. Indicates that each cluster has one slice. The value cannot be 0 and must be an integer of 2, such as 1, 2, 4, 8, 16, 32, 64, or 128. However, this value cannot exceed 32 KB for each cluster.

5. offset address: 0EH; Length: 2; content: 08 00. Convert it to 00 08, which means that the number of reserved sectors in the reserved area is 8. The starting address of FAT1 is: 0x08*0x200 (number of bytes per sector) = 0x1000.

6. The offset address is 10 H and the length is 1. The content is 02. The number of copies of the FAT structure in this volume is 2, and the other is backed up.

7. offset address 11 H, length 2, content: 00 02. The conversion is 0200 H, indicating the total number of 32-byte files and folder name items that can be saved in the Root directory folder of the partition (Root Entries. The value of this field is 512 on a typical hard disk.

8. The offset address is 13 H and the length is 2. The content is 4D ED. The conversion is ED4DH, that is, about 32 MB of SD card storage. Small Sector ). The number of sectors on the partition, which is 16 bits (<65536 ). For a partition with more than 65536 sectors, the value of this field is 0, and it is replaced by a large number of sectors.

9. 16 H offset address, length 2, content: EC 00. Convert to 00EC, indicating the number of sectors occupied by each FAT. The number of bytes occupied by each slice is 0x00EC * 0x200 = 0x1D800. Based on the order of the boot zone, FAT1, FAT2, root directory, and data zone, you can calculate their addresses in sequence. (The offset address given in the tutorial is 24 H, but it should be 16 H based on the actual FAT1/FAT2 address)

10. offset address 20 H, length 2, content: 00 00. Represents the number of Large sectors (Large Sector ). If the value of the number segment of a small sector is 0, this field contains the total number of sectors in the FAT16 partition. If the value of the number segment of a small sector is not 0, the value of this field is 0.

11. the offset address is 36 H and the length is 8. The content is 46 41 54 31 36 20 20. If the ASCII code is "FAT16", it indicates the File System Type) the value of this field can be FAT, FAT12, or FAT16 Based on the disk format.

Start zone: 0x00;

FAT1: 0x1000;

FAT2: 0x1000 + 0x1D800 = 0x1E800;

Root directory: 0x1E800 + 0x1D800 = 0x3C000;

The address of the data area, and so on. This is just a calculation. You can see if it is consistent with the actual one.

 

 

 

 

Is it consistent with the computing.

Why do we need to calculate the address given for reading SD data, and each read is a full-sector, 512 bytes. After finding these addresses, you can easily find the data.

Now, analyze the content in the root directory:

 

Here, the FAT16 short file directory is used. Each 32 bytes represents a file (the folder is also), and the 32 bytes are defined as follows:

Description of 32 bytes of the FAT16 directory item
Byte offset (hexadecimal)	Bytes	Definition
0x0 ~ 0x7	8	File Name
0x8 ~ 0xA	3	Extension
0xB	1	Attribute bytes	00000000 (read/write)
			00000001 (read-only)
			00000010 (hidden)
			00000100 (system)
			00001000 (volume label)
			00010000 (subdirectory)
			00100000 (archive)
0xC ~ 0x15	10	System reservation
0x16 ~ 0x17	2	Last file modification time
0x18 ~ 0x19	2	Last file modification date
0x1A ~ 0x1B	2	Indicates the first cluster number of the file.
0x1C ~ 0x1F	4	Indicates the object length.

 

1. offset address 00 H, length 8, content: Drive name, 8 bytes. Here, CCD8 corresponds to the Country Code "special", and C8A8 corresponds to the Country Code "right", that is, the "Privilege" that privileged students give to the SD card.

2. offset address 20 H, length 8, content: 54 45 53 54 20 20 20. Indicates the first file name: TEST (the vacant part is space ).

Offset address 80 H, length 8, content: 4E 45 58 54 20 20 20. Indicates the second file name: NEXT (the vacant part is space ).

3. The offset address is 28 H (88H is also the same). The length is 3 and the content is 54 58 54. Indicates the file type, which is an ASCII character.

4. The offset address 2BH (8BH is also the same). The length is 1 and the content is 20. Indicates file attributes, including 00000000 (read/write), 00000001 (read-only), 00000010 (hidden), 00000100 (system), 00001000 (volume label), 00010000 (subdirectory), and 00100000 (archive ).

5. The offset address is 36 H, the length is 2, and the content is BA 49. Time = hour * 2048 + minutes * 32 + seconds/2. Convert the result to hexadecimal format. That is, 0 ~ of 36 h bytes ~ 4 bits are measured in 2 seconds; 5 to 36 h bytes ~ 7-bit and 37-H bytes ~ 2 bits are minutes; 3 ~ of 37 h bytes ~ 7 digits are hours.

6. The offset address is 38 H and the length is 2. The content is A3 3A. Indicates the date = (year-1980) * 512 + month * 32 + day. Convert the result to hexadecimal format. That is, 38H bytes 0 ~ The four digits are the number of days; the 38 H byte is 5 ~ 7-bit and 39H-byte 0-bit are months; 39H-byte 1 ~ The 7-digit is the year number. In the original definition, 0 ~ 119 represents 1980 ~ 2099. Currently, Windows in later versions allow 0 ~ 127, that is, the maximum number of years can reach 2107.

7. The offset address is 3AH and the length is 2. The cluster number is started for the file, which is also organized in Small-end format. If the conversion is 00, then you can find the location of the next cluster number in FAT1 in test.txt. 1000 H + 02 H * 02 H (because there is a cluster number in 2 bytes) = 1004 H.

The offset address is 3AH and the length is 2. It starts the cluster number for the file, which is also organized in Small-end format. Convert to 00 then you can find the location of the next cluster number in the file next.txt in fat1. 1000 H + 62 H * 02 H (because two bytes store a cluster number) = 10C4H.

8. offset address 3CH, length 4, content: 59 BE 00. Indicates the file length. After conversion, 00 00 BE 59 is 48729 bytes.

Offset address 9CH, length 4, content: 32 00 00. Indicates the file length. After conversion, the value 00 00 32 indicates 50 bytes.

TEST.txt occupies 48 KB space and NEXT occupies B space. Files are stored by the whole cluster. The size of a cluster is not enough (calculated from the preceding figure, a cluster is a sector (512B), and the space of a cluster is also required.

Calculates the storage space of the file.

The file size can be used to calculate the number of clusters. Based on the preceding data, each cluster has one slice and each slice has 512 bytes. The space of a cluster is 512 bytes. Then 96 clusters are required for 48729 bytes. The starting address of these 96 clusters can be calculated.

 

First of all, we need to mention that this is what privileged students found only after finding a lot of information, that is, the root folder in the root directory occupies 32 (20 H) slice size should be fixed (at least for FAT16), so the real user data storage should start from the offset of the 32 slice in the root directory address.

Notice: test.txt is the offset of the cluster address stored in FAT1: 02h. You can calculate the first cluster data storage address of test.txt: 3C000H (root directory address) + 20 H * 200 H (user data offset mentioned above) + (02 H-02 H) * 01 H (1 cluster has 1 Sector) * 200 H = 40000 H. The offset-02H indicates that the cluster number is stored in fat1.

The first cluster address is stored in FAT1: 1000 H (FAT1 start address) + 02 H * 02 H = 1004 H. The data on the 1004H address is: 03, 0003h after conversion, so we can calculate the address of test.txt second cluster: 3C000H (root directory address) + 20 H * 200 H (user data offset mentioned above) + (03 H-02 H) * 01 H (1 cluster has 1 Sector) * 200 H = 40200 (the first cluster start address ). Until the offset in FAT1 is C2, FF ffoccurs, and the storage of test.txt file ends. The first H is the offset of the last cluster in the file. We can calculate the file size as follows: (0061 H-0002 H + 0001 H (Compensation) = 96 clusters, which is consistent with the actual.

Similarly, you can calculate the storage address of the next.txt file. Starting from beginning to end, the offset of the address is 62h. you can calculate the first cluster data storage address of next.txt as: 3C000H (root directory address) + 20 H * 200 H (user data offset mentioned above) + (62 H-02 H) * 01 H (one cluster has one sector) * 200 H = 4C000H. The first cluster address is stored in FAT1: 1000 H (FAT1 start address) + 62 H * 02 H = 10C4H. The data on the 10C4H address is FF ff, that is, because ntxt.txt is less than one cluster, it can only be allocated to the address space of one cluster.

 

 

 

FAT16 File System

The FAT16 file system does not support partitions larger than 4 GB. use NTFS.
 
What layer is the maximum directory depth in the FAT16 file system?

There is no limit on directory depth in principle, but after all, recording directory information takes up disk space. Therefore, the number of directories on any disk is limited by the capacity, not unlimited.

FAT16 has 512 root directory items, each of which is 32 bytes. If it is a short file name, a directory item stores the information of a file (folder, including the file name, starting cluster number, attributes, and other information. If a long file name is used, multiple directory items are used to save the information. Therefore, if you encounter a long file name, the maximum number of directory items in the root directory is 512, but the number of files (folders) that can be saved is reduced.