Appendix D: FAT32 Boot Sector Layout

OFFSET LOCATION

# OF BYTES

IDENTIFIER

NOTES

00

3

Jumpcode

Contains the jumpshort instruction (1 byte), the offset of the bootstrap code (1 byte), and a NOP.

03

8

OEM name

The name of the OS that formatted the partition. Can be used to determine legacy OS presence.

0B

2

# of bytes per sector

The total number of bytes each sector holds.

0D

1

# of sectors per cluster

The total number of sectors each cluster holds.

0D

2

# of reserved sectors

The number of reserved for sectors the boot record.

10

1

# of FATs

The total number of File Allocation Tables. This is usually 2 (one primary plus one backup).

11

2

Root entries

The maximum number of entries possible in the root entry. Sets the number of subdirectories off root that are allowed.

13

2

Total sectors

Total number of sectors. Used for partitions smaller than 32MB and floppy drives .

15

1

Media type

F0 for a floppy drive, F8 for a hard drive.

16

2

# of sectors per FAT

Total number of sectors in each FAT. Used for FAT12/16.

18

2

# of sectors per track

Total number of sectors in each track.

1A

2

# of heads per cylinder

Total number of drive heads.

1C

4

# of hidden sectors

The number of sectors in the MBR until the boot record begins.

20

4

Total sectors

The total number of sectors in the partition. Used for partitions larger than 32MB.

24

4

# of sectors per FAT

Total number of sectors in each FAT. Used for FAT32.

28

2

Flags

Reserved for determining FAT mirroring status. Allows for the use of the backup FAT as the primary on FAT32 systems.

2A

2

Version

The file system version number.

2C

4

Root cluster

The cluster number where the root cluster begins.

30

2

Info sector

The sector number of the file system information sector.

32

2

Boot backup location

The sector number of the boot area backup location on the drive (if present).

34

12

Reserved

Reserved for future use.

40

1

Drive Id

00 for a floppy disk, 80 for a hard disk.

41

1

NT reserved

Set to 00 by NT when the drive is formatted.

42

1

Extended boot signature

Set to 29 to indicate the presence of the serial number, partition name, and FAT type are present.

43

4

Volume serial number

A unique number assigned to a partition at format time. Both Quick and Full formats reassign a serial number.

47

11

Volume/partition name

An 11-character name assigned to the volume by the person formatting the drive.

52

8

FAT type

FAT12, FAT16, or FAT32. This is used by some utilities, but not the OS itself.

5A

420

Executable bootstrap

Starts the first file to boot the system itself.

01 FE

2

Executable signature

Added as 55 AA when formatted. Otherwise, the operating system will not be registered by the BIOS as present.



Windows Forensics. The Field Guide for Corporate Computer Investigations
Windows Forensics: The Field Guide for Corporate Computer Investigations
ISBN: 0470038624
EAN: 2147483647
Year: 2006
Pages: 71
Authors: Chad Steel

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net