File Allocation Table fat (File Allocation Table)

The file allocation table is used to indicate the space allocation information of disk files. Directory Table information is not actually stored.

When a file occupies disk space, the basic unit is not a byte but a cluster. The cluster size is related to the disk type. Generally, each cluster of a floppy disk is one sector, and the number of sectors of each cluster of the hard disk is related to the total capacity of the hard disk, which is the Npower of 2, may be 4, 8, 16, 32, 64 ......
Because fat is used for files Management So fat has a backup, that is, the same fat is created after the original fat. All items in the initial fat are marked as "not occupied", but if the disk is partially damaged, the formatting program will detect the damaged cluster, when the corresponding item is named "Bad cluster", the cluster will no longer be used when files are stored. The number of fat items is the same as the total number of clusters on the hard disk. The number of bytes occupied by each item must be consistent with the total number of clusters, because the number of clusters must be stored. There are many fat formats, the most common and familiar to readers are fat16 and FAT32. fat16 indicates that the File Allocation Table uses 16 digits, A 16-Bit Allocation Table can manage up to 65536 clusters (that is, the 16 power of 2), that is, a specified hard disk partition.
Because the storage of each cluster Space The maximum storage capacity is 32 KB. Therefore, when fat16 is used to manage the hard disk, the maximum storage capacity of each partition is only 65536 × 32 KB, that is, 2048 MB. We 2G. The current hard disk capacity is getting bigger and bigger. Due to fat16's limitation on hard disk partition capacity, when the hard disk capacity exceeds 2 GB, you can only divide the hard disk into multiple 2 GB partitions before it can be used normally, for this reason, Microsoft started to use the FAT32 standard in Windows 95 osr2, that is, using a 32-bit File Allocation Table to manage hard disk files, so that the system can allocate up to 4294967296 (that is, 2 to the power of 32) to files) so when the cluster is also 32 KB, the maximum capacity of each partition can be more than 65 GB. In addition, when FAT32 is used to manage hard disks, the cluster length in each Logical Disk is much smaller than the same capacity Logical Disk managed using fat16. Because the disk space occupied by files stored on the hard disk is the smallest unit of cluster, a file must occupy the entire cluster even if it contains dozens of bytes, therefore, the smaller the cluster capacity of the Logical Disk, the more reasonable the storage space can be used. Therefore, FAT32 is more suitable for large hard disks.


When a file occupies disk space, the basic unit is not a byte but a cluster. The cluster size is related to the disk type. Generally, each cluster of a floppy disk is one sector.

The number of sectors in each cluster of the hard disk depends on the total capacity of the hard disk. The values are as follows:

Partition size fat16 (number of sectors/cluster) FAT32 (number of sectors/cluster)
16 MB-127 MB 4 1
128 MB-255 MB 8 1
256 Mbit/s-259 Mbit/s 16 1
260 MB-511 MB 16 8
512 Mbit/s-1023 Mbit/s 32 8
1024 MB-2047 MB 64 8
2048 MB-8 GB does not support 8
8 GB-16 GB does not support 16
16 GB-32 GB does not support 32
32 GB or above does not support 64


The specific values of fat16 and FAT32 are as follows:

Fat16
1. Start from DBR 0th slice. One slice is used and no slice is retained.
2. The fat table is 2 bytes long at the 16h of DBR (indicating the number of occupied sectors), and fat1 starts from 1st sectors.
3. Each fat cluster uses 16-bit binary numbers to indicate that each cluster address occupies 2 bytes in the fat table.
4. Available Cluster No. 0002 H-ffefh (<= ffedh [65518] clusters)
5. The specific cluster numbers 0000 H and H are not used. The corresponding DWORD location: F8 FF 7f
The value of the cluster indicates that the number in the fat table cannot be mistaken for the current cluster number. Instead, it must be the cluster number of the next cluster in the file.
High bytes are stored in front of the back and low bytes, and should be adjusted when reading data. For example, if two bytes are 12 H 34 h, the actual value should be 3412 H.
The value fff0h indicates the bad cluster value ffffh indicates the end cluster of the file.
The specific value indicates the bad cluster, and the other value indicates the cluster number of the next cluster occupied by the file.
6. the size of the sector in the root directory. If the value is 00 02, the size of the slice in the 11h section of DBR (indicating the number of root directories in 32 bytes) is 0200 H = 512, that is, 512*32 bytes = 16384 bytes, equal to 32 sectors
7. The number of sectors is 2 bytes at the 13h of DBR.

FAT32
1. DBR starts from 0th sectors and uses three sectors to store important parameters and boot records, such as the number of bytes per sector and the number of sectors corresponding to each cluster. (using 32 zones)
2. The fat table is 4 bytes long at 24 h of DBR (indicating the number of sectors occupied by fat), and fat1 starts from 32nd.
3. Each cluster address occupies 4 bytes in the fat table of the fat cluster.
4. Available Cluster No. 00000002 H-fffffeffh
5. the specified cluster numbers 0000000 H and H are not used. The corresponding two DWORD locations (eight bytes starting with the fat table) are used to store the media type numbers of the Disk: f8 FF 0f FF 0f
*
The specific value indicates the bad cluster, and the other value indicates the cluster number of the next cluster occupied by the file.
6. The sector size of the root directory is no longer a fixed area or a fixed size.
7. The number of sectors is 4 bytes at 20 h of DBR


Others:
1. The fat table records the usage of each cluster on the disk in sequence.
2. The number of sectors occupied by each cluster is shown in the preceding figure.
3. Microsoft recommends that you do not use FAT32 for logical disks smaller than MB.
4. For Hard Disk Partitions using the fat16 file system, do not set the partition (Logical Disk) Capacity to the lower limit of a certain range.


Calculation formula:
Length of each slice = 512 bytes
Total number of clusters = Logical Disk capacity/cluster capacity
Total number of clusters = fat table length (bytes)/length of each table item (bytes)-2
Fat table length = Logical Disk capacity/cluster capacity * length of each table item
Each valid fat structure zone contains two identical copies: fat1 and fat2.

For example, if the HD format is 2g fat 16, the fat length is 250 sectors,
The total number of clusters = 250*512/2-2 = 63998
Cluster capacity (number of sectors per cluster) = 2 097 000 000/63998 = 32776 bytes = 64 sectors

File directory table (FDT) is the root directory (DIR) area, also known as the root partition.
The starting unit and attributes of each file (directory) in the root directory are recorded immediately following the next sector of fat2. When locating the file location, the operating system can know the specific location and size of the file on the hard disk based on the starting unit in the Dir and the fat table.
If long file names are supported, each table item is 64 bytes. The first 32 bytes are long file links, and the last 32 bytes are file attributes, including the file length, start address, date, and time. If long file names are not supported, the attribute description of each table item is 32 bytes.

The root directory can contain files and subdirectories, And the subdirectories can also contain files and sub-directories. A sub-directory also occupies a file directory item, except that its attribute byte is 10 h and the file Length byte is 0. A sub-directory contains several file directory items or sub-directory items.

Start pos. bytes fat16 FAT32
00-07 8 file name
08-0a 3 File Extension
0b 1 fat16: // attribute: 00000000 read/write 00000001 write only 00000010 implicit 00000111 system, implicit, read-only 00000100 system 00001000 标00010000 00100000 sub-directory file, once the write operation is completed and disabled, set it to 1.
FAT32: // 0 to 5 digits are read-only, hidden, system, volume, subdirectory, and archive.
Up to two reserved unused

0c-0d 2 retain the unstored short file name byte checksum
0e-0f 2 retain the creation time of unused files
10-11 2 retention Date of unused files
12-13 2 retain unused latest access dates
14-15 2 keep the 16-bit high starting cluster number that is not used for file storage
16-17 2 File Creation Time (hhhhhmmmmmmsssss) file latest modification time
18-19 2 file creation date (yyyyymmmmddddd) file latest modification date
1A-1B 2 the starting cluster number (low byte before) of the file to store the starting cluster number is 16 bits
1c-1f 4 file length


Note: 0th ~ 7 bytes is the file name (if there are any remaining bytes, fill it with a blank character for 20 h ).
The 1st bytes indicate Status It has the following four values:
A. 00 h -- the empty directory of the Directory item.
B. e5h -- indicates that the directory item has been used, but the file has been deleted.
C. 2EH -- two sub-Directories Special File "." or "..." directory item
D. Any other character-represents the ASCII value of the first character of a file name (or directory name.


Data Area
The data zone is the place where data is stored in the real sense. After the Dir zone, it occupies most of the data space on the hard disk.
File data start address (Sector number) = number of reserved sectors (DBR) + number of fat sectors X 2 + number of root directory items/32 (number of FDT sectors) + number of sectors per cluster * (Starting cluster number-2)

When a program requires the Operating System Provide When the content of a file, the operating system will go to the directory record table of the file to find its first cluster number, and then go to the fat record table to find the chain). This action repeats until the last cluster of the file is found. The operating system can accurately calculate the cluster belonging to this file and its sequence. In this way, the operating system can provide any part of the file required by the program. The organization file is called fat chain ).
In the FAT file system, files are always allocated to clusters in integer units. In a 32 k gb disk, a disk contains only "Hello, world! "The size of these characters is 12 bytes and the size of the file still occupies 32 kb in the disk. The unused parts in the cluster are called Server Load balancer (Slack). The loss of small files is almost the same as that of the entire cluster. On average, a file may suffer about half of the loss.
File Reading: the operating system reads files from the directory area. Information (Including the file name, suffix name, file size, modification date, and the cluster number of the first cluster saved in the data area), we suppose the first cluster number is 0023. The operating system reads the corresponding data from the 0023 cluster, and then finds the fat 0023 unit. If the content is a file end sign (ff), the file ends, otherwise, repeat the cluster number of the next cluster where the data is stored until the end of the file is reached.

File writing: when we want to save the file, the operating system first finds the file name, size, and Creation Time of the Empty Area in the Dir area, then, find the idle space in the data area to save the file and write the first cluster in the data area to the Dir area. The other actions are similar to the read actions above.

When deleting a file, DOS only changes The 0th bytes of the table item in the file directory table to e5h. The table item has been deleted, in the file allocation table, clear the table items in each cluster occupied by the file to free up space. The reason why the undelete.exe‑unerase.exe and other types of restoration and deletion tools can work is still being deleted on the disk.