📄 fat32 structure information.htm
字号:
<TD width=60 height=19>Offset</TD>
<TD width=329 height=19>Description</TD>
<TD width=110 height=19>Size</TD></TR>
<TR>
<TD width=60 height=10>00h</TD>
<TD width=329 height=10>Jump Code + NOP</TD>
<TD width=110 height=10>3 Bytes</TD></TR>
<TR>
<TD width=60 height=25>03h</TD>
<TD width=329 height=25>OEM Name (Probably MSWIN4.1)</TD>
<TD width=110 height=25>8 Bytes</TD></TR>
<TR>
<TD width=60 height=6>0Bh</TD>
<TD width=329 height=6>Bytes Per Sector</TD>
<TD width=110 height=6>1 Word</TD></TR>
<TR>
<TD width=60 height=7>0Dh</TD>
<TD width=329 height=7>Sectors Per Cluster</TD>
<TD width=110 height=7>1 Byte</TD></TR>
<TR>
<TD width=60 height=12>0Eh</TD>
<TD width=329 height=12>Reserved Sectors</TD>
<TD width=110 height=12>1 Word</TD></TR>
<TR>
<TD width=60 height=7>10h</TD>
<TD width=328 height=7>Number of Copies of FAT</TD>
<TD width=111 height=7>1 Byte</TD></TR>
<TR>
<TD width=60 height=4>11h</TD>
<TD width=328 height=4>Maximum Root Directory Entries (N/A for FAT32)</TD>
<TD width=111 height=4>1 Word</TD></TR>
<TR>
<TD width=60 height=5>13h</TD>
<TD width=328 height=5>Number of Sectors in Partition Smaller than 32MB
(N/A for FAT32)</TD>
<TD width=111 height=5>1 Word</TD></TR>
<TR>
<TD width=60 height=8>15h</TD>
<TD width=328 height=8>Media Descriptor (F8h for Hard Disks)</TD>
<TD width=111 height=8>1 Byte</TD></TR>
<TR>
<TD width=60 height=4>16h</TD>
<TD width=328 height=4>Sectors Per FAT in Older FAT Systems (N/A for
FAT32)</TD>
<TD width=111 height=4>1 Word</TD></TR>
<TR>
<TD width=61 height=14>18h</TD>
<TD width=328 height=14>Sectors Per Track</TD>
<TD width=111 height=14>1 Word</TD></TR>
<TR>
<TD width=61 height=23>1Ah</TD>
<TD width=328 height=23>Number of Heads</TD>
<TD width=111 height=23>1 Word</TD></TR>
<TR>
<TD width=61 height=22>1Ch</TD>
<TD width=328 height=22>Number of Hidden Sectors in Partition</TD>
<TD width=111 height=22>1 Double Word</TD></TR>
<TR>
<TD width=61 height=22>20h</TD>
<TD width=328 height=22>Number of Sectors in Partition</TD>
<TD width=111 height=22>1 Double Word</TD></TR>
<TR>
<TD width=61 height=22>24h</TD>
<TD width=328 height=22>Number of Sectors Per FAT</TD>
<TD width=111 height=22>1 Double Word</TD></TR>
<TR>
<TD width=61 height=22>28h</TD>
<TD width=328 height=22>Flags (Bits 0-4 Indicate Active FAT Copy) (Bit 7
Indicates whether FAT Mirroring is Enabled or Disabled <Clear is
Enabled>) (If FAT Mirroring is Disabled, the FAT Information is only
written to the copy indicated by bits 0-4)</TD>
<TD width=111 height=22>1 Word</TD></TR>
<TR>
<TD width=61 height=22>2Ah</TD>
<TD width=328 height=22>Version of FAT32 Drive (High Byte = Major Version,
Low Byte = Minor Version)</TD>
<TD width=111 height=22>1 Word</TD></TR>
<TR>
<TD width=61 height=22>2Ch</TD>
<TD width=328 height=22>Cluster Number of the Start of the Root
Directory</TD>
<TD width=111 height=22>1 Double Word</TD></TR>
<TR>
<TD width=61 height=22>30h</TD>
<TD width=328 height=22>Sector Number of the File System Information
Sector (See Structure Below) (Referenced from the Start of the
Partition)</TD>
<TD width=111 height=22>1 Word</TD></TR>
<TR>
<TD width=61 height=22>32h</TD>
<TD width=328 height=22>Sector Number of the Backup Boot Sector
(Referenced from the Start of the Partition)</TD>
<TD width=111 height=22>1 Word</TD></TR>
<TR>
<TD width=61 height=22>34h</TD>
<TD width=328 height=22>Reserved</TD>
<TD width=111 height=22>12 Bytes</TD></TR>
<TR>
<TD width=61 height=22>40h</TD>
<TD width=328 height=22>Logical Drive Number of Partition</TD>
<TD width=111 height=22>1 Byte</TD></TR>
<TR>
<TD width=61 height=22>41h</TD>
<TD width=328 height=22>Unused (Could be High Byte of Previous Entry)</TD>
<TD width=111 height=22>1 Byte</TD></TR>
<TR>
<TD width=61 height=22>42h</TD>
<TD width=328 height=22>Extended Signature (29h)</TD>
<TD width=111 height=22>1 Byte</TD></TR>
<TR>
<TD width=61 height=22>43h</TD>
<TD width=328 height=22>Serial Number of Partition</TD>
<TD width=111 height=22>1 Double Word</TD></TR>
<TR>
<TD width=61 height=22>47h</TD>
<TD width=328 height=22>Volume Name of Partition</TD>
<TD width=111 height=22>11 Bytes</TD></TR>
<TR>
<TD width=61 height=22>52h</TD>
<TD width=328 height=22>FAT Name (FAT32)</TD>
<TD width=111 height=22>8 Bytes</TD></TR>
<TR>
<TD width=61 height=22>5Ah</TD>
<TD width=328 height=22>Executable Code</TD>
<TD width=111 height=22>420 Bytes</TD></TR>
<TR>
<TD width=61 height=22>1FEh</TD>
<TD width=328 height=22>Boot Record Signature (55h AAh)</TD>
<TD width=111 height=22>2 Bytes</TD></TR></TBODY></TABLE></DIV>
<P><BR><U><STRONG>File System Information Sector</STRONG></U></P>
<BLOCKQUOTE>
<P>Usually this is the Second Sector of the partition, although since there is
a reference in the Boot Sector to it, I'm assuming it can be moved
around. I never got a complete picture of this one. Although I do
know where the important fields are at.</P></BLOCKQUOTE>
<DIV align=left>
<TABLE height=65 width=521 border=1>
<TBODY>
<TR>
<TD width=63 height=13>Offset</TD>
<TD width=331 height=13>Description</TD>
<TD width=109 height=13>Size</TD></TR>
<TR>
<TD width=63 height=14>00h</TD>
<TD width=331 height=14>First Signature (52h 52h 61h 41h)</TD>
<TD width=109 height=14>1 Double Word</TD></TR>
<TR>
<TD width=63 height=14>04h</TD>
<TD width=331 height=14>Unknown, Currently (Might just be Null)</TD>
<TD width=109 height=14>480 Bytes</TD></TR>
<TR>
<TD width=63 height=14>1E4h</TD>
<TD width=331 height=14>Signature of FSInfo Sector (72h 72h 41h 61h)</TD>
<TD width=109 height=14>1 Double Word</TD></TR>
<TR>
<TD width=63 height=14>1E8h</TD>
<TD width=331 height=14>Number of Free Clusters (Set to -1 if Unknown)</TD>
<TD width=109 height=14>1 Double Word</TD></TR>
<TR>
<TD width=63 height=14>1ECh</TD>
<TD width=331 height=14>Cluster Number of Cluster that was Most Recently
Allocated.</TD>
<TD width=109 height=14>1 Double Word</TD></TR>
<TR>
<TD width=63 height=14>1F0h</TD>
<TD width=331 height=14>Reserved</TD>
<TD width=109 height=14>12 Bytes</TD></TR>
<TR>
<TD width=63 height=14>1FCh</TD>
<TD width=331 height=14>Unknown or Null</TD>
<TD width=109 height=14>2 Bytes</TD></TR>
<TR>
<TD width=63 height=14>1FEh</TD>
<TD width=331 height=14>Boot Record Signature (55h AAh)</TD>
<TD width=109 height=14>2 Bytes</TD></TR></TBODY></TABLE></DIV>
<P><BR><U><STRONG>FAT32 Drive Layout</STRONG></U></P>
<DIV align=left>
<TABLE height=64 width=521 border=1>
<TBODY>
<TR>
<TD width=374 height=23>Offset</TD>
<TD width=111 height=23>Description</TD></TR>
<TR>
<TD width=374 height=10>Start of Partition</TD>
<TD width=111 height=10>Boot Sector</TD></TR>
<TR>
<TD width=374 height=12>Start + # of Reserved Sectors</TD>
<TD width=111 height=12>Fat Tables</TD></TR>
<TR>
<TD width=374 height=12>Start + # of Reserved + (# of Sectors Per FAT * 2)
<Assuming that FAT Mirroring is Enabled, I personally haven't seen a
case where it wasn't, but I guess there is always the possibility></TD>
<TD width=111 height=12>Data Area (Starts with Cluster
#2)</TD></TR></TBODY></TABLE></DIV>
<P> </P>
<P><U><STRONG>Cluster Meaning</STRONG></U></P>
<BLOCKQUOTE>
<P>A Cluster is a Group of Sectors on the Hard Drive that have information in
them. A 4K Cluster has 8 Sectors in it (512*8=4096). Each Cluster
is given a spot in the FAT Table. When you look at an Entry in the FAT,
the number there tells you whether or not that cluster has data in it, and if
so, if it is the end of the data or there is another cluster after it.
All Data on a Partition starts with Cluster #2. If the FAT Entry
is 0, then there is no data in that cluster. If the FAT Entry is
0FFFFFFFh, then it is the last entry in the chain. </P>
<P>This is one of my biggest holes in my information. I am unable to
find anyplace that shows what numbers mean what when it comes to the FAT
table. I was able to tell the end of the chain just by looking at a
FAT32 Drive, but I don't know what stands for a BAD Cluster or what the
maximum valid number for showing data is. </P>
<P>For now, you can calculate the maximum valid cluster in a partition with
this formula:</P>
<P>( (# of Sectors in Partition) - (# of Sectors per Fat * 2) - (# of Reserved
Sectors) ) / (# of Sectors per Cluster)</P>
<P>If there is any remainder in the answer to that formula, it just means that
there were a few extra clusters at the end of the partition (probably not
enough to make another cluster), so you can just get rid of anything after the
decimal point.</P>
<P> Thanks to Andrew Clausen for pointing this formula out
to me.</P></BLOCKQUOTE>
<P> </P>
<P><U><STRONG>Directory Table</STRONG></U></P>
<BLOCKQUOTE>
<P>Another aspect when looking at a File System at Low Level is the Directory
Table. The Directory Table is what stores all of the File and Directory
Entries. Basically there is only one difference between the Directory
Table of FAT16 and FAT32, so go <A
href="http://www.teleport.com/~brainy/lfn.htm">here</A> to look at FAT16's
Structure. The Difference is : the Reserved OS/2 Byte (Offset 20
[14h]) in the Short Filename Structure is replaced with the High Word of the
Cluster Number (since it's now 4 bytes instead of 2).</P></BLOCKQUOTE>
<P> </P>
<P>Footnotes</P>
<P>1 - LBA = Logical Block Addressing - Uses the Int 13h Extensions built into
newer BIOS's to access data above the 8GB barrier, or to access strickly in LBA
mode, instead of CHS (Cylinder, Head, Sector).</P>
<P align=center><A href="http://www.teleport.com/~brainy">Home</A> <A
href="http://www.teleport.com/~brainy/rps.html">Reference Point Software</A>
FAT32 Structure Information <A
href="http://www.teleport.com/~brainy/fat16.htm">FAT16 Structure Information</A>
<A href="http://www.teleport.com/~brainy/diskaccess.htm">Disk Access
Information</A> <BR><A href="http://www.teleport.com/~brainy/bio.html">About
Me</A> <A href="http://www.teleport.com/~brainy/links.html">Links</A> <A
href="http://www.teleport.com/~brainy/dobiash.html">Dobiash?</A></P></BODY></HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -