Operating Systems (CS 330)
FAT File System
Deadline 11th December
Small storage devices, like 4GB pen drive use FAT file system. FAT is one of the oldest file systems and most operating systems support it. Windows and Linux support FAT file system. In this project you will study FAT and use your knowledge to attempt retrieving a deleted file from a FAT storage device. You will use a tool class known as disk editors for this purpose. (There are many disk editors available online as freeware. One such disk editor is Active@ Disk Editor available for download at www.disk-editor.org)
The following is a brief description of FAT.
There are three variants of FAT file system: FAT12, FAT16 and FAT32. They differ from each other in the way file allocation table is built. A typical layout of FAT volume is shown below:
FAT 2 (Duplicate)
Other Folders and Files (Data Area of the Disk)
The boot sector contains the bootstrap program for loading operating system into the memory. It also contains important information about the rest of the file system e.g. total number of clusters in the disk, etc. This info is contained in BIOS parameter block (BPB) and extended BIOS parameter block, within the boot sector. More information about the boot sector can be obtained from: https://technet.microsoft.com/en-us/library/cc976796.aspx
File allocation table or FAT occupies sectors immediately after the boot sector. FAT has one entry or record for each cluster in the disk. FAT16 record is two bytes while as FAT32 record is four bytes. The record identifies the cluster as one of the following: (i) an un-used cluster (0x00000000) (ii) a cluster in use by a file (> 0x00000001) (iii) a bad cluster (0xFFFFFFF7) (iv) last cluster in a file (0xFFFFFFF8 – 0xFFFFFFFF). Values are indicated for FAT32. A FAT has a fixed number of records depending on the size of the disk.
Root folder follows the second copy of FAT. It has an entry for every file and sub-folder in it. In FAT16, the difference between root folder and any other (sub) folder is that root folder is in the fixed location and is of fixed size with space allocated for it at the time of formatting. (Thus there is an upper limit on the number of files and folders that can appear in the root folder.) In FAT32, root folder is the part of the data area of the disk, just like any other file or folder. Data area of the disk is arranged in clusters, first cluster number being 2. The format of all folders is the same. Each entry in a folder is 32 bytes long and includes attributes, such as, name, extension, time created or updated, starting cluster number, size, etc.
Here is a simple example from technet.microsoft.com:
The array indexed from 0 to 8 is the FAT. The above are the entries in the root directory for files named FILE1.TXT, FILE2.TXT and FILE3.TXT. Only two attributes for each file are shown – file name and the starting cluster. Thus FILE2.TXT is stored in clusters starting at cluster 5 and then at 6 and 8.
As the first step, open the USB flash drive in the disk editor and locate the boot sector. Read the following information about the flash drive from the BPB and extended-BPB of the boot sector. You will have to refer to online references for the format of the boot sector, for example: https://technet.microsoft.com/en-us/library/cc976796.aspx
(a) What is the sector size – i.e. bytes per sector? (512)
(b) What is the cluster size – i.e. sectors per cluster? (32)
(c) How many hidden sectors are there? Hidden sectors are the first few sectors of the disk. (32)
(d) How many reserved sectors are there? Reserved sectors follow the hidden sectors and include the boot sector. Boot sector is regarded as sector 0. (18)
(e) How many copies of the boot sector does it have?
(f) What is the total number of sectors? (15,633,376)
(g) How many copies of the FAT are there? (2)
(h) What is the FAT size – sectors per FAT? (3815)
(i) What is the cluster number of the root directory? This is the same as the first cluster of the data area. (2)
(j) What is the first sector of the root directory i.e. the first sector of the data area? (114752)
Numbers in brackets are values for the instructor’s 5GB pen drive.
Now try to locate your sample file in the root directory. Obtain its starting cluster number and access the starting cluster in the FAT. What is the value for this cluster in the FAT? Obtain the chain of clusters that store file’s data from the FAT. Note that if your file is small it may fit in just one cluster with FAT entry for the cluster indicating this is the last and the only cluster of the file. Access the starting and other clusters of the file and verify that the clusters have file’s data.
Delete your sample file and see the effect on the file’s entry in the root directory. Is the first cluster of the file indicated in the root directory? What about the FAT entry for the starting cluster – what is it value? Can you obtain the file’s chain of clusters? What about the data in the file’s clusters – do they still have the data? If you are able to find the file’s data, try to retrieve it.