File Allocation Table (FAT)


Until the release of Windows XP, the most commonly used file systems were based on a file allocation table (FAT), which keeps track of the data stored in each cluster on a disk. FAT is still the most universally understood file system, meaning it is recognized by virtually every operating system that runs on PCs, and even non-PCs. For example, FAT is even recognizable on Apple Mac systems. For this reason, although NTFS (covered later in this chapter in the section "NTFS") is usually recommended with Windows XP, for greater compatibility across systems and platforms, most external hard disks and removable-media drives still use FAT as their native file systems. Also, if you want to dual-boot Windows XP and Windows 9x/Me, you need to use FAT-based file systems even on your main drives .

Three main varieties of the FAT system exist, called FAT12, FAT16, and FAT32all of which are differentiated by the number of digits used in the allocation table numbers. In other words, FAT16 uses 16-bit numbers to keep track of data clusters, FAT32 uses 32-bit numbers , and so on. The various FAT systems are used as follows :

  • FAT12. Used on all volumes smaller than 16MiB (for example, floppy disks).

  • FAT16. Used on volumes from 16MiB through 2GiB by MS-DOS 3.0 and most versions of Windows. Windows NT, Windows 2000, and Windows XP support FAT16 volumes as large as 4GiB. However, FAT16 volumes larger than 2GiB cannot be used by MS-DOS or Windows 9x/Me.

  • FAT32. Optionally used on volumes from 512MiB through 2GiB, and required on all FAT volumes over 2GiB, starting with Windows 95B (OSR 2.x) and subsequent versions.

FAT12 and FAT16 are the file systems originally used by DOS and Windows and are supported by every other PC operating system from past to present. An add-on to the FAT file systems called VFAT is found in Windows 95 and newer. VFAT is a driver in Windows that adds the capability to use long filenames on existing FAT systems. When running Windows 95 or newer , VFAT is automatically enabled for all FAT volumes.

Although all PC operating systems support FAT12 and FAT16, Windows 2000 and XP also have support for FAT32 as well as non-FAT file systems such as NTFS.

FAT12

FAT12 was the first file system used in the PC when it was released on August 12, 1981, and because it is so efficient on small volumes, it is still used today on all floppy disks as well as hard disk and other removable storage media FAT volumes less than 16MiB. FAT12 uses a table of 12-bit numbers to manage the clusters (also called allocation units ) on a disk. A cluster is the storage unit in the data area of the disk where files are stored. Each file uses a minimum of one cluster, and files that are larger than one cluster use additional space in cluster increments . FAT12 cluster sizes are shown in Table 10.20.

Table 10.20. FAT12 Cluster Sizes

Media Type

Volume Size

Sectors per Cluster

Cluster Size

5 1/4" DD floppy disk

360K

2

1KiB

3 1/2" DD floppy disk

720K

2

1KiB

5 1/4" HD floppy disk

1.2MB

1

0.5KiB

3 1/2" HD floppy disk

1.44MB

1

0.5KiB

3 1/2" ED floppy disk

2.88MB

2

1KiB

Other media

015.9MiB

8

4KiB

DD = Double density

HD = High density

ED = Extra-high density

KiB = Kibibyte = 1,024 bytes

MiB = Mebibyte = 1,048,576 bytes


Each cluster on a FAT12 volume is typically 8 sectors in size, except on floppy disks, where the size varies according to the particular floppy type. 12-bit cluster numbers range from 000h to FFFh (hexadecimal), which is 04,095 in decimal. This theoretically allows 4,096 total clusters; however, 11 of the cluster numbers are reserved and cannot be assigned to actual clusters on a disk. Cluster numbers start at 2 (0 and 1 are reserved), number FF7h is reserved to indicate a bad cluster, and numbers FF8hFFFh indicate an end-of-chain in the FAT, leaving 4,085 clusters (4,096 11 = 4,085). Microsoft subtracts 1 from this to eliminate boundary problems, allowing up to exactly 4,084 clusters maximum in a FAT12 volume.

FAT12 volumes include 1 sector for the boot record and BPB (BIOS parameter block), two copies of the FAT (up to 12 sectors long each), up to 32 sectors for the root folder (less only on floppy disk media), and a data area with up to 4,084 clusters. Because each FAT12 cluster is 8 sectors (except on floppy disks), FAT12 volumes are limited to a maximum size of 32,729 sectors (1 sector for the boot record + 12 sectors per FAT x 2 FATs + 32 sectors for the root folder + 4084 clusters x 8 sectors per cluster). This equals 16.76MB or 15.98MiB. FAT12 volume limits are detailed in Table 10.21.

Table 10.21. FAT12 Volume Limits

Volume Limit

Clusters

Sectors per Cluster

Total Volume Sectors

Volume Size (Decimal)

Volume Size (Binary)

Maximum size

4,084

8

32,729

16.76MB

15.98MiB

MB = Megabyte = 1,000,000 bytes

MiB = Mebibyte = 1,048,576 bytes


PC/MS-DOS 1.x and 2.x use FAT12 exclusively, and all later versions of DOS and all Windows versions automatically create a FAT12 file system on any disks or partitions that are 32,729 sectors or less (16.76MB) in size. Anything larger than that is automatically formatted as FAT16, FAT32, or NTFS. Characteristics of FAT12 include the following:

  • Is used on all floppy disks

  • Has a default format on FAT volumes of 16.76MB (15.98MiB) or less

  • Is supported by all versions of DOS and Windows

  • Is supported by all operating systems capable of reading PC disks

FAT12 is still used in PCs today on very small media because the 12-bit tables are smaller than those for FAT16 and FAT32, which preserves the most space for data.

FAT16

FAT16 is similar to FAT12 except it uses 16-bit numbers to manage the clusters on a disk. FAT16 was introduced on August 14, 1984, along with PC/MS-DOS 3.0, with the intention of supporting larger hard drives. FAT16 picked up where FAT12 left off and was used on media or partitions larger than 32,729 sectors (15.98MiB or 16.76MB). FAT16 could theoretically support drives of up to 2GiB or 4GiB. However, even with FAT16, DOS 3.3 and earlier were still limited to a maximum partition size of 32MiB (33.55MB) because DOS 3.3 and earlier used only 16-bit sector addressing internally and in the BPB (BIOS parameter block, stored in the volume boot sector, which is the first logical sector in a FAT partition). The use of 16-bit sector values limited DOS 3.3 and earlier to supporting drives of up to 65,535 sectors of 512 bytes, which is 32MiB (33.55MB).

As a temporary way to address drives larger than 32MiB, PC/MS-DOS 3.3 (released on April 2, 1987) introduced the extended partition, which could internally support up to 23 subpartitions (logical drives) of up to 32MiB each. Combined with the primary partition on a disk, this allowed for a total of 24 partitions of up to 32MiB each, which would be seen by the operating system as logical drives CZ.

To take full advantage of FAT16 and allow for larger drives and partition sizes, Microsoft collaborated with Compaq, who introduced Compaq DOS 3.31 in November 1987. It was the first OS to use 32-bit sector addressing internally and in the BPB. Then the rest of the PC world followed suit on July 19, 1988, when Microsoft and IBM released PC/MS-DOS 4.0. This enabled FAT16 to handle partition sizes up to 2GiB using 64 sectors per cluster.

Each cluster in a FAT16 volume is up to 64 sectors in size. 16-bit cluster numbers range from 0000h to FFFFh, which is 065,535 in decimal. This theoretically allows 65,536 total clusters. However, 11 of the cluster numbers are reserved and cannot be assigned to actual clusters on a disk. Cluster numbers start at 2 (0 and 1 are reserved), number FFF7h is reserved to indicate a bad cluster, and numbers FFF8hFFFFh indicate an end of chain in the FAT, leaving 65,525 clusters (65,536 11 = 65,525). Microsoft subtracts 1 from this to eliminate boundary problems, allowing up to 65,524 clusters maximum in a FAT16 volume. FAT16 cluster sizes are shown in Table 10.22.

Table 10.22. FAT16 Cluster Sizes

Volume Size

Sectors per Cluster

Cluster Size

4.1MiB15.96MiB [1]

2

1KiB

>15.96MiB128MiB

4

2KiB

>128MiB256MiB

8

4KiB

>256MiB512MiB

16

8KiB

>512MiB1GiB

32

16KiB

>1GiB2GiB

64

32KiB

>2GiB4GiB [2]

128

64KiB

MB = Megabyte = 1,000,000 bytes

KiB = Kibibyte = 1,024 bytes

MiB = Mebibyte = 1,024KiB = 1,048,576 bytes

GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes


[1] Volumes smaller than 16MiB default to FAT12; however, FAT32 can be forced by altering the format parameters.

[2] Volumes larger than 2GiB are supported only by Windows NT/2000/XP and are not recommended.

FAT16 volumes include 1 sector for the boot record and BPB, two copies of the FAT (default and backup) up to 256 sectors long each, 32 sectors for the root folder, and a data area with up to 65,524 clusters. Each FAT16 cluster can be up to 64 sectors (32KiB) in size, meaning FAT16 volumes are limited to a maximum size of 4,194,081 sectors (1 sector for the boot record + 256 sectors per FAT x 2 FATs + 32 sectors for the root folder + 65,524 clusters x 64 sectors per cluster). This equals a maximum capacity of 2.15GB or 2GiB. FAT16 volume limits are shown in Table 10.23.

Table 10.23. FAT16 Volume Limits

Volume Limit

Clusters

Sectors per Cluster

Total Volume Sectors

Volume Size (Decimal)

Volume Size (Binary)

Minimum size

4,167

2

8,401

4.3MB

4.1MiB

DOS 3.03.3 max.

16,343

4

65,533

33.55MB

32MiB

Win9x/Me max.

65,524

64

4,194,081

2.15GB

2GiB

NT/2000/XP max.

65,524

128

8,387,617

4.29GB

4GiB

MB = Megabyte = 1,000,000 bytes

GB = Gigabyte = 1,000

MB = 1,000,000,000 bytes

MiB = Mebibyte = 1,048,576 bytes

GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes


Note

Windows NT/2000/XP can optionally create FAT16 volumes that use 128 sectors per cluster (64KiB) in size, bringing the maximum volume size to 4.29GB or 4GiB. However any volumes formatted in that manner are not readable in virtually any other OS. Additionally, 64KiB clusters cause many disk utilities to fail. For maximum compatibility, FAT16 volumes should be limited to 32KiB clusters and 2.15GB/2GiB in size.


Some notable characteristics and features of FAT16 include

  • FAT16 is fully supported by MS-DOS 3.31 and higher, all versions of Windows, and some UNIX operating systems.

  • FAT16 is fast and efficient on volumes smaller than 256MiB but relatively inefficient on larger volumes because the cluster size becomes much larger than with FAT32 and NTFS.

  • The boot sector information is not automatically backed up, and if damaged or destroyed , access to the volume is lost.

  • In case of a problem, you can boot the system using any MS-DOS bootable floppy to troubleshoot the problem and if necessary, repair the volume. Many third-party software tools can repair or recover data from FAT16 volumes.

  • The root directory (folder) can handle up to a maximum of 512 entries, which is further reduced if any root entries use long filenames.

  • FAT16 has no built-in security, encryption, or compression capability.

  • File sizes on a FAT16 volume are limited only by the size of the volume. Because each file takes a minimum of one cluster, FAT16 volumes cannot have more than 65,524 total files.

VFAT and Long Filenames

The original Windows 95 release introduced what is essentially the same FAT16 file system as was used in MS-DOS 6.x and earlier, except for a few important enhancements. Like much of the rest of Windows 95, the operating system support for the FAT file system was rewritten using 32-bit code and called VFAT (virtual file allocation table) . VFAT works in combination with the 32-bit protected mode VCACHE (which replaces the 16-bit real mode SMARTDrive cache used in DOS and Windows 3.1) to provide better file system performance. However, the most obvious improvement in VFAT is its support for long filenames. DOS and Windows 3.1 had been encumbered by the standard 8.3 file-naming convention for many years , and adding long filename support was a high priority in Windows 95particularly in light of the fact that Macintosh and OS/2 users had long enjoyed this capability.

The problem for the Windows 95 designers, as is often the case in the PC industry, was backward compatibility. It is no great feat to make long filenames possible when you are designing a new file system from scratch, as Microsoft did years before with Windows NT's NTFS. However, the Windows 95 developers wanted to add long filenames to the existing FAT file system and still make it possible to store those names on existing DOS volumes and for previous versions of DOS and Windows to access the files.

VFAT provides the capability to assign file and folder names that are up to 255 characters in length (including the length of the path ). The three-character extension is maintained because, like previous Windows versions, Windows 9x relies on the extensions to associate file types with specific applications. VFAT's long filenames can also include spaces, as well as the following characters , which standard DOS 8.3 names can't: +,;=[].

The first problem when implementing the long filenames was how to make them usable to previous versions of DOS as well as older 16-bit Windows applications that supported only 8.3 names. The resolution to this problem was to give each file two names: a long filename and an alias that uses the traditional 8.3 naming convention. When you create a file with a long filename in Windows 9x/Me, VFAT uses the following process to create an equivalent 8.3 alias name :

1.
The first three characters after the last dot in the long filename become the extension of the alias.

2.
The first six characters of the long filename (excluding spaces, which are ignored) are converted into uppercase and become the first six characters of the alias filename. If any of these six characters are illegal under the standard 8.3 naming rules (that is, +,;=[]), VFAT converts those characters into underscores.

3.
VFAT adds the two characters ~1 as the seventh and eighth characters of the alias filename, unless this will result in a name conflict, in which case it uses ~2, ~3, and so on, as necessary.

Aliasing in Windows NT/2000/XP

Note that Windows NT/2000/XP creates aliases differently than Windows 9x/Me (as shown later).

NT/2000/XP begins by taking the first six legal characters in the LFN and following them with a tilde and number. If the first six characters are unique, a number 1 follows the tilde.

If the first six characters aren't unique, a number 2 is added. NT/2000/XP uses the first three legal characters following the last period in the LFN for a file extension.

At the fifth iteration of this process, NT/2000/XP takes only the first two legal characters, performs a hash on the filename to produce four hexadecimal characters, places the four hex characters after the first two legal characters, and appends a ~5. The ~5 remains for all subsequent aliases; only the hex numbers change.

For example, I created six files using long names under Windows XP, and the automatically generated alias (short names) were as follows:

Long File Name (LFN)

Alias (created by Windows)

New Text Document.txt

NEWTEX~1.TXT

New Text Document (2).txt

NEWTEX~2.TXT

New Text Document (3).txt

NEWTEX~3.TXT

New Text Document (4).txt

NEWTEX~4.TXT

New Text Document (5).txt

NE5A0A~1.TXT

New Text Document (6).txt

NE5A04~1.TXT


Note how the algorithm changes after the fifth file.


Tip

You can modify the behavior of the VFAT filename truncation mechanism to make it use the first eight characters of the long filename instead of the first six characters plus ~1. To do this, you must add a new binary value to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem Registry key called NameNumericTail , with a value of . Changing the value to 1 returns the truncation process to its original state.

Although this Registry change creates more "friendly" looking alias names, it causes many programs working with alias names to fail and is not recommended.


VFAT stores this alias filename in the standard name field of the file's folder entry. Any version of DOS or 16-bit Windows can therefore access the file using the alias name. The big problem that still remains, however, is where to store the long filenames. Clearly, storing a 255-character filename in a 32-byte folder entry is impossible (because each character requires 1 byte). However, modifying the structure of the folder entry would make the files unusable by previous DOS versions.

The developers of VFAT resolved this problem by using additional folder entries to store the long filenames. Each of the folder entries is still 32 bytes long, so up to 8 might be required for each long name, depending on its length. To ensure that these additional folder entries are not misinterpreted by earlier DOS versions, VFAT flags them with a combination of attributes that is not possible for a normal file: read-only, hidden, system, and volume label. These attributes cause DOS to ignore the long filename entries, while preventing them from being mistakenly overwritten.

Caution

When using long filenames on a standard FAT12 or FAT16 partition, you should avoid storing them in the root folder. Files with long names that take up multiple folder entries can more easily use up the limited number of entries allotted to the root folder than files with 8.3 names. On FAT32 drives, this is not a problem because the root folder has an unlimited number of entries.

In an experiment, I created a small (1KiB) text file on a floppy disk and gave it a 135-character long filename using Windows 98. I copied the file and pasted it repeatedly into the root folder of a floppy disk using Windows Explorer. Before I could make 20 copies of the file, the system displayed a File copying error. The disk could not accept any more files because the multiple copies of the extremely long filename had used up all the root folder entries.


This solution for implementing backward-compatible long filenames in Windows 9x is ingenious, but it is not without its problems. Most of these problems stem from the use of applications that can access only the 8.3 alias names assigned to files. In some cases, if you open a file with a long name using one of these programs and save it again, the connection to the additional folder entries containing the long name is severed and the long name is lost.

This is especially true for older versions of disk utilities, such as Norton Disk Doctor for MS-DOS, that are not designed to support VFAT. Most older applications ignore the additional folder entries because of the combination of attributes assigned to them, but disk repair utilities usually are designed to detect and "correct" discrepancies of this type. The result is that running an old version of Norton Disk Doctor on a partition with long filenames results in the loss of all the long names. In the same way, backup utilities not designed for use with VFAT can strip off the long filenames from a partition.

Note

When using VFAT's long filename capabilities, you definitely should use disk and backup utilities that are intended to support VFAT. Windows 9x includes VFAT-compatible disk repair, defragmentation, and backup programs. If, however, you are for some reason inclined to use an older program that does not support VFAT, Windows 9x includes a clumsy, but effective, solution.

A program is included on the Windows 9x CD-ROM called LFNBK.EXE. It doesn't install with the operating system, but you can use it to strip the long filenames from a VFAT volume and store them in a text file called LFNBK.DAT . You can then work with the files on the volume as though they were standard 8.3 FAT files. Afterward, you can use LFNBK.EXE to restore the long filenames to their original places ( assuming the file and folder structure has not changed). This is not a convenient solution, nor is it recommended for use in anything but extraordinary circumstances, but the capability is there if needed. Some backup programs designed for disaster recovery (which enable you to reconstruct the contents of the hard drive without reloading Windows first) have used this feature to enable restoration of a Windows drive with long filenames from a DOS prompt (where only 8.3 alias names usually are supported).


Another problem with VFAT's long filenames involves the process by which the file system creates the 8.3 alias names. VFAT creates a new alias every time you create or copy a file into a new folder; therefore, the alias can change. For example, you might have a file called Expenses-January-Travel.doc stored in a folder with the alias EXPENS~1.DOC . If you use Windows 9x Explorer to copy this file to a folder that already contains a file called Expenses-December-Travel.doc , you are likely to find that this existing file is already using the alias EXPENS~1.DOC . In this case, VFAT assigns EXPENS~2.DOC as the alias of the newly copied file, with no warning to the user. This is not a problem for applications that support VFAT because the long filenames are unchanged, but a user running an older application might open the EXPENS~1.DOC file expecting to find the list of January travel expenses and see the December travel expenses list instead.

FAT32

FAT32 is an enhanced version of the FAT file system first supported by Windows 95B (also known as OEM Service Release 2, released in August 1996). FAT32 is also supported in Windows 98/Me and Windows 2000/XP. FAT32 is not supported in MS-DOS 6.xx or earlier, the original release of Windows 95 or in any release of Windows NT.

FAT32 works just like FAT16; the only difference is that it uses numbers with more digits, so it can manage more clusters on a disk. Unlike VFAT, which is a Windows innovation that used existing FAT12/16 file system structures to handle long filenames, FAT32 is an enhancement of the entire FAT file system. FAT32 was first included in the Windows 95 OEM Service Release 2 (OSR2, also known as Windows 95B) and is also part of Windows 98/Me, Windows 2000/XP and later.

One of the main reasons for creating FAT32 was to use disk space more efficiently . FAT32 uses smaller clusters (4KiB clusters for drives up to 8GiB in size), resulting in a 10%15% more efficient use of disk space relative to large FAT16 drives. FAT32 also supports partitions of up to 2TiB in size, much larger than the 2GiB limit of FAT16. FAT32 cluster sizes are shown in Table 10.24.

Table 10.24. FAT32 Cluster Sizes

Volume Size

Sectors per Cluster

Cluster Size

32.52MiB260MiB [1]

1

0.5KiB

>260MiB8GiB

8

4KiB

>8GiB16GiB

16

8KiB

>16GiB32GiB

32

16KiB

>32GiB2TiB [2]

64

32KiB

MB = Megabyte = 1,000,000 bytes

GB = Gigabyte = 1,000MB = 1,000,000,000 bytes

TB = Terabyte = 1,000GB = 1,000,000,000,000 bytes

KiB = Kibibytes = 1,024 bytes

MiB = Mebibyte = 1,024KiB = 1,048,576 bytes

GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes

TiB = Tebibytes = 1,024GiB = 1,099,511,627,776 bytes


[1] Volumes smaller than 512MiB will default to FAT16, although FAT32 can be forced by altering the format parameters.

[2] Windows 2000 and XP format FAT32 volumes only up to 32GiB; however, they support existing FAT32 volumes up to 2TiB.

Although the name implies that FAT32 uses 32-bit numbers to manage clusters (allocation units) on a disk, FAT32 actually uses only the first 28 bits of each 32-bit entry, leaving the high 4 bits reserved. The only time the high 4 bits are changed is when the volume is formatted, at which time the whole 32-bit entry is zeroed (including the high 4 bits). The high 4 bits are subsequently ignored when reading or writing FAT32 cluster entries; therefore, if those bits are non-zero , they are preserved. Microsoft has never indicated any purpose for them other than simply being reserved.

So, although the FAT32 entries are technically 32-bit numbers, FAT32 really uses 28-bit numbers to manage the clusters on a disk. Each cluster on a FAT32 volume is from 1 sector (512 bytes) to 64 sectors (32KiB) in size. 28-bit cluster numbers range from 0000000h to FFFFFFFh, which is 0268,435,455 in decimal. This theoretically allows for 268,435,456 total clusters. However 11 of the numbers are reserved and cannot be assigned to actual clusters on a disk. Cluster numbers start at 2 (0 and 1 are reserved), the number FFFFFF7h is reserved to indicate a bad cluster, and numbers FFFFFF8hFFFFFFFh indicate an end of chain in the FAT, leaving exactly 268,435,445 clusters maximum (268,435,456 11 = 268,435,445).

FAT32 volumes reserve the first 32 sectors for the boot record, which includes both the default boot record (3 sectors long, starting at logical sector 0) and a backup boot record (also 3 sectors long, but starting at logical sector 6). The remaining sectors in that area are reserved and filled with 0s. Following the 32 reserved sectors are 2 FATs (default and backup) that can be anywhere from 512 sectors to 2,097,152 sectors in length, with a data area 65,525268,435,445 clusters.

Each FAT32 cluster is up to 64 sectors (32KiB) in size, so FAT32 disks or partitions could theoretically be up to 17,184,062,816 sectors (32 sectors for the boot record + 2,097,152 sectors per FAT x 2 FATs + 268,435,445 clusters x 64 sectors per cluster), which equals a capacity of 8.8TB or 8TiB. This capacity is theoretical because the 32-bit sector numbering scheme used in the partition tables located in the master boot record (MBR) limits a disk to no more than 4,294,967,295 (2 32 1) sectors, which is 2.2TB or 2TiB. Therefore, although FAT32 can in theory handle a volume of up to 8.8TB (terabytes or trillions of bytes), the reality is that we are currently limited by the 32-bit sector numbering in the partition table format of the MBR to only 2.2TB. At the current rate of hard disk capacity growth, single drives of that size will debut between the years 2009 and 2011. Of course, by that time the MBR limitation should be addressed.

Individual files can be up to 1 byte less than 4GiB in size and are limited by the size field in the folder entry, which is 4 bytes long. Because the clusters are numbered using 32-bit values instead of 16-bit ones, the format of the folder entries on a FAT32 partition must be changed slightly. The 2-byte Link to Start Cluster field is increased to 4 bytes, using 2 of the 10 bytes (bytes 1221) in the folder entry that were reserved for future use.

Note

If you attempt to format a FAT32 volume larger than 32GiB on a system running Windows 2000 or Windows XP, the format fails near the end of the process with the following error:

 Logical Disk Manager: Volume size too big. 

This is by design. The format tools included with Windows 2000/XP and later will not format a volume larger than 32GiB using the FAT32 file system. Only the format tools are restricted as such; any preexisting volumes up to 2TiB are otherwise fully supported. The limitation is entirely voluntary; Microsoft is basically trying to force you to use NTFS on any newly created volumes larger than 32GiB. Unfortunately this means that if you are formatting an external USB or FireWire drive that will be moved between various systems, some of which include Windows 9x/Me or even Apple Mac systems, you must either format the drive on a Windows 98 or Me system, or use a third-party utility such as the SwissKnife program (available for free from www.compuapps.com) to partition and format the drive.

Windows 95 OSR2 and Windows 98 have additional limitations with FAT32. The ScanDisk tool included with those operating systems is a 16-bit program that has a maximum allocation size for a single memory block of 16MB minus 64KB. This means that ScanDisk cannot process volumes using the FAT32 file system that have a FAT larger than 16MB minus 64KB in size. Each FAT32 entry uses 4 bytes, so ScanDisk cannot process the FAT on a volume using the FAT32 file system that defines more than 4,177,920 clusters, which after subtracting the two reserved clusters leaves 4,177,918 actual clusters. At 32KiB per clusterincluding the boot sector reserved area and the FATs themselvesthis results in a maximum volume size of 136.94GB or 127.53GiB. The ScanDisk versions included with Windows Me and later do not have this limitation.


Table 10.25 lists the volume limits for a FAT32 file system.

Table 10.25. FAT32 Volume Limits

Volume Limit

Clusters

Sectors per Cluster

Total Volume Sectors

Volume Size (Decimal)

Volume Size (Binary)

Minimum size

65,535

1

66,601

34.1MB

32.52MiB

MBR max.

67,092,481

64

4,294,967,266

2.2TB

2TiB

Theoretical max.

268,435,445

64

17,184,062,816

8.8TB

8TiB

MB = Megabyte = 1,000,000 bytes

GB = Gigabyte = 1,000MB = 1,000,000,000 bytes

TB = Terabyte = 1,000GB = 1,000,000,000,000 bytes

KiB = Kibibytes = 1,024 bytes

MiB = Mebibyte = 1,024KiB = 1,048,576 bytes

GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes

TiB = Tebibytes = 1,024GiB = 1,099,511,627,776 bytes


FAT32 is more robust than FAT12 or FAT16. FAT12/16 uses the first sector of a volume for the volume boot record, which is a critical structure. If the boot sector is damaged or destroyed, access to the entire volume is lost. FAT32 improves on this by creating both a default and a backup volume boot record in the first 32 sectors of the volume, which are reserved for this purpose. Each FAT32 volume boot record is 3 sectors long. The default boot record is in logical sectors 02 (the first three sectors) in the partition, and the backup is in sectors 68. This feature has saved me on several occasions when the default boot record was damaged and access to the entire volume was lost. In these situations, I was still able to recover the entire volume by manually restoring the volume boot record from the backup by using a sector editor such as Norton Diskedit (included with Norton SystemWorks by Symantec ). Because FAT12 and FAT16 do not create a backup boot sector, if the boot sector is destroyed on those volumes, it must be re-created manually from scratcha much more difficult proposition.

Another important difference in FAT32 partitions is the nature of the root folder. In a FAT32 partition, the root folder does not occupy a fixed position on the disk as in a FAT16 partition. Instead, it can be located anywhere in the partition and expand to any size. This eliminates the preset limit on root folder entries and provides the infrastructure necessary to make FAT32 partitions dynamically resizable. Unfortunately, Microsoft never implemented that feature in Windows, but third-party products such as PartitionMagic from Symantec can take advantage of this capability.

As with FAT12/16, FAT32 also maintains two copies of the FAT and automatically switches to the backup FAT if a sector in the default FAT becomes unreadable. The root directory (folder) in a FAT16 system is exactly 32 sectors long and immediately follows the two FAT copies; however, in FAT32, the root folder is actually created as a subdirectory (folder) that is stored as a file, relocatable to anywhere in the partition, and extendable in length. Therefore, a 512-file limit no longer exists in the root folder for FAT32 as there was with FAT12/16.

The main drawback of FAT32 is that it is not compatible with previous versions of DOS and Windows 95. You can't boot to a previous version of DOS or (pre-OSR2) Windows 95 from a FAT32 drive, nor can a system started with an old DOS or Windows 95 boot disk see FAT32 partitions. Most recent distributions of Linux now support FAT32, and even the Mac OS 8.1 and later can read and write FAT32 volumes. For all but the oldest of equipment, FAT32 is the most universally understandable format that supports larger volumes.

Some notable characteristics and features of FAT32 include the following:

  • FAT32 is fully supported by Windows 95B (OSR2), 98, Me, 2000, XP, and later versions.

  • MS-DOS 6.22 and earlier, Windows 95a, and Windows NT do not support FAT32 and cannot read or write FAT32 volumes.

  • Mac OS 8.1 and later support FAT32 drives.

  • FAT32 is the ideal format for large, external USB or FireWire drives that will be moved between various PC and Mac systems.

  • The root directory (folder) is stored as a subfolder file that can be located anywhere on the volume. Subdirectories (folders) including the root can handle up to 65,534 entries, which is further reduced if any entries use long filenames.

  • FAT32 uses smaller clusters (4KiB for volumes up to 8GiB), so space is allocated much more efficiently than FAT16.

  • The critical boot sector is backed up at logical sector 6 on the volume.

  • Windows 2000 and XP format FAT32 volumes only up to 32GiB. To format FAT32 volumes larger than 32GiB, you must format the volume on a Windows 98/Me system.

  • In case of a boot problem, you must start the system using a bootable disk created using Windows 95B (OSR2), 98, Me, 2000, or XP. A limited number of third-party software tools can repair or recover data from FAT32 volumes.

  • FAT32 has no built-in security, encryption, or compression capability.

  • File sizes on FAT32 volumes are limited to 4,294,967,295 bytes (2 32 1), which is 1 byte less than 4GiB in size.

FAT Mirroring

FAT32 also takes greater advantage of the two copies of the FAT stored on a disk partition. On a FAT16 partition, the first copy of the FAT is always the primary copy and replicates its data to the secondary FAT, sometimes corrupting it in the process. On a FAT32 partition, when the system detects a problem with the primary copy of the FAT, it can switch to the other copy, which then becomes the primary. The system can also disable the FAT mirroring process to prevent the viable FAT from being corrupted by the other copy. This provides a greater degree of fault tolerance to FAT32 partitions, often enabling you to repair a damaged FAT without an immediate system interruption or a loss of table data.

Converting FAT16 to FAT32

If you want to convert an existing FAT16 partition to FAT32, Windows 98 and Me later include a FAT32 Conversion Wizard that enables you to migrate existing partitions in place.

The wizard gathers the information needed to perform the conversion, informs you of the consequences of implementing FAT32, and attempts to prevent data loss and other problems. After you have selected the drive you want to convert, the wizard performs a scan for applications (such as disk utilities) that might not function properly on the converted partition. The wizard gives you the opportunity to remove these and warns you to back up the data on the partition before proceeding with the conversion. Even if you don't use the Microsoft Backup utility the wizard offers, backing up your data is a strongly recommended precaution.

Because the conversion must deal with the existing partition data in addition to creating new volume boot record information, FATs, and clusters, the process can take far longer than partitioning and formatting an empty drive. Depending on the amount of data involved and the new cluster size, the conversion can take several hours to complete.

After you convert a FAT16 partition to FAT32, you can't convert it back with Windows tools, except by destroying the partition and using FDISK to create a new one. After-market partitioning utilities are available that can convert FAT32 back to FAT16 if you want. You should take precautions before beginning the conversion process, such as connecting the system to a UPS. A power failure during the conversion could result in a loss of data.

Third-Party Partitioning Utilities

Windows includes only basic tools for creating FAT32 partitions, but programs such as Partition Commander from VCOM (www.v-com.com) and PartitionMagic from Symantec (www.symantec.com) provide many other partition manipulation features. These programs can easily convert partitions back and forth between FAT16, FAT32, NTFS, and other file systems, as well as resize, move, and copy partitions without destroying the data they contain. They also allow changes in cluster sizes beyond what the standard Windows tools create.


File Allocation Table Tutorial

You can think of the FAT as a type of spreadsheet that tracks the allocation of the disk's clusters. Each cell in the spreadsheet corresponds to a single cluster on the disk. The number stored in that cell is a code indicating whether a file uses the cluster and, if so, where the next cluster of the file is located. Thus, to determine which clusters a particular file is using, you would start by looking at the first FAT reference in the file's folder entry. When you look up the referenced cluster in the FAT, the table contains a reference to the file's next cluster. Each FAT reference, therefore, points to the next cluster in what is called a FAT chain until you reach the cluster containing the end of the file. Numbers stored in the FAT are hexadecimal numbers that are either 12 or 16 bits long. The 16-bit FAT numbers are easy to follow in a disk sector editor because they take an even 2 bytes of space. The 12-bit numbers are 1 1/2 bytes long, which presents a problem because most disk sector editors show data in byte units. To edit a 12-bit FAT, you must do some hex/binary math to convert the displayed byte units to FAT numbers. Fortunately (unless you are using the DOS DEBUG program), most of the available tools and utility programs have a FAT-editing mode that automatically converts the numbers for you. Most of them also show the FAT numbers in decimal form, which most people find easier to handle.

With FAT16, the cluster numbers are stored as 16-bit entries, from 0000h to FFFFh. The largest value possible is FFFFh, which corresponds to 65,535 in decimal, but several numbers at the beginning and end are reserved for special use. The actual cluster numbers allowed in a FAT16 system range from 0002h to FFF6h, which is 265,526 in decimal. All files must be stored in cluster numbers within that range. That leaves only 65,524 valid clusters to use for storing files (cluster numbers below 2 and above 65,526 are reserved), meaning a partition must be broken up into that many clusters or less. A typical file entry under FAT16 might look like Table 10.26.

Table 10.26. FAT16 File Entries

Folder

Name

Starting Cluster

Size

USCONST.TXT

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1002

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

Cluster available

...

...

...

65526

Last cluster available


In this example, the folder entry states that the file starts in cluster number 1000. In the FAT, that cluster has a nonzero value, which indicates it is in use; the specific value indicates where the file using it would continue. In this case, the entry for cluster 1000 is 1001, which means the file continues in cluster 1001. The entry in 1001 points to 1002, and from 1002 the entry points to 1003. The entry for 1003 is FFFFh, which is an indication that the cluster is in use but that the file ends here and uses no additional clusters.

The use of the FAT becomes clearer when you see that files can be fragmented . Let's say that before the USCONST.TXT file was written, another file already occupied clusters 1002 and 1003. If USCONST.TXT was written starting at 1000, it would not have been capable of being completely written before running into the other file. As such, the operating system would skip over the used clusters and continue the file in the next available cluster. The end result is shown in Table 10.27.

Table 10.27. Folder and FAT Relationship (Fragmented File)

Folder

Name

Starting Cluster

Size

PLEDGE.TXT

1002

2

USCONST.TXT

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1004

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

1005

In use, points to next cluster

01005

FFFFh

End of file

...

...

...

65526

Last cluster available


In this example, the PLEDGE.TXT file that was previously written interrupted USCONST.TXT , so those clusters are skipped over, and the pointers in the FAT reflect that. Note that the defrag programs included with DOS and Windows take an example like this and move the files so they are contiguous, one after the other, and update the FAT to indicate the change in cluster use.

The first two entries in the FAT are reserved and contain information about the table itself. All remaining entries correspond to specific clusters on the disk. Most FAT entries consist of a reference to another cluster containing the next part of a particular file. However, some FAT entries contain hexadecimal values with special meanings, as follows:

  • 0000h. Indicates that the cluster is not in use by a file

  • FFF7h. Indicates that at least one sector in the cluster is damaged and that it should not be used to store data

  • FFF8hFFFFh. Indicates that the cluster contains the end of a file and that no reference to another cluster is necessary

To compare FAT16 and FAT32, you can look at how a file would be stored on each. With FAT32, the cluster numbers range from 00000000h to 0FFFFFFFh, which is 0268,435,455 in decimal. Again, some values at the low and high ends are reserved, and only values between 00000002h and 0FFFFFF6h are valid, which means values 2268,435,446 are valid. This leaves 268,435,445 valid entries, so the drive must be split into that many clusters or less. Because a drive can be split into so many more clusters, the clusters can be smaller, which conserves disk space. The same file as shown earlier could be stored on a FAT32 system as illustrated in Table 10.28.

Table 10.28. FAT32 File Entries

Folder

Name

Starting Cluster

Size

USCONST.TXT

1000

8

FAT32 File Allocation Table

FAT Cluster #

Value

Meaning

0000000002

First cluster available

...

...

...

0000000999

Cluster available

0000001000

1001

In use, points to next cluster

0000001001

1002

In use, points to next cluster

0000001002

1003

In use, points to next cluster

0000001003

1004

In use, points to next cluster

0000001004

1005

In use, points to next cluster

0000001005

1006

In use, points to next cluster

0000001006

1007

In use, points to next cluster

0000001007

0FFFFFFFh

End of file

0000001008

Cluster available

...

...

...

268,435,446

Last cluster available


Because the FAT32 system enables many more clusters to be allocated, the cluster size is usually smaller. So, although files overall use more individual clusters, less wasted space results because the last cluster is, on average, only half filled.

Some additional limitations exist on FAT32 volumes. Volumes less than 512MiB default to FAT16, but FAT32 partitions as small as 32.52MiB can be forced using the proper utilities or commands. Anything smaller than that, however, must be either FAT16 or FAT12.

Using smaller clusters results in many more clusters and more entries in the FAT. A 2GiB partition using FAT32 requires up to 524,288 FAT entries, whereas the same drive needs only 65,536 entries using FAT16. Thus, the size of one copy of the FAT16 table is 128KiB (65,536 entriesx16 bits = 1,048,576 bits/8 = 131,072 bytes/1,024 = 128KiB), whereas the FAT32 table is 2MiB in size.

The size of the FAT has a definite impact on the performance of the file system. Windows 9x/Me uses VCACHE to keep the FAT in memory at all times to improve file system performance. The use of 4KiB clusters for drives up to 8GiB in size is, therefore, a reasonable compromise for the average PC's memory capacity. If the file system were to use clusters equal to one disk sector (1 sector = 512KiB) in an attempt to minimize slack as much as possible, the FAT table for a 2GiB drive would contain 4,194,304 entries and be 16MB in size.

This would monopolize a substantial portion of the memory in the average system, probably resulting in noticeably degraded performance. Although at first it might seem as though even a 2MB FAT is quite large when compared to 128KiB, keep in mind that hard disk drives are a great deal faster now than they were when the FAT file system was originally designed. In practice, FAT32 typically results in a minor (less than 5%) improvement in file system performance. However, systems that perform a great many sequential disk writes might see an equally minor degradation in performance.

The partitioning program generally determines whether a 12-bit, 16-bit, or 32-bit FAT is placed on a disk, even though the FAT isn't written until you perform a high-level format (using the FORMAT utility). On today's systems, usually only floppy disks use 12-bit FATs, but FDISK also creates a 12-bit FAT if you create a hard disk volume that is smaller than 16MiB. On hard disk volumes of more than 16MiB, FDISK creates a 16-bit FAT. On drives larger than 512MiB, the FDISK program included in Windows 95 OSR2, and Windows 98/Me enables you to create 32-bit FATs when you answer yes to the question Enable Large Disk Support? when you start FDISK. You can also select FAT32 when you prepare a drive with the Windows 2000 or Windows XP Disk Management program (Windows NT doesn't support FAT32).

FAT volumes normally have two copies of the FAT. Each one occupies contiguous sectors on the disk, and the second FAT copy immediately follows the first. Unfortunately, the operating system uses the second FAT copy only if sectors in the first FAT copy become unreadable. If the first FAT copy is corrupted, which is a much more common problem, the operating system does not use the second FAT copy. Even the CHKDSK command does not check or verify the second FAT copy. Moreover, whenever the OS updates the first FAT, it automatically copies large portions of the first FAT to the second FAT. If the first copy was corrupted and subsequently updated by the OS, a large portion of the first FAT is copied over to the second FAT copy, damaging it in the process. After the update, the second copy is usually a mirror image of the first one, complete with any corruption. Two FATs rarely stay out of sync for very long. When they are out of sync and the OS writes to the disk, it updates the first FAT and overwrites the second FAT with the first. This is why disk repair and recovery utilities warn you to stop working as soon as you detect a FAT problem. Programs such as Norton Disk Doctor (included with the Norton Utilities which are a part of Norton SystemWorks) use the second copy of the FAT as a reference to repair the first one, but if the OS has already updated the second FAT, repair might be impossible.

Directories (Folders)

A directory is a simple database containing information about the files stored on a FAT partition. Directories are also called folders in Windows.

Each record in a folder is 32 bytes long, with no delimiters or separating characters between the fields or records. A folder stores almost all the information that the operating system knows about a file, including the following:

  • Filename and extension. The eight-character name and three-character extension of the file. The dot between the name and the extension is implied but not included in the entry.

    Note

    To see how Windows extends filenames to allow 255 characters within the 8.3 folder structure, see the section "VFAT and Long Filenames," in this chapter.


  • File attribute byte. The byte containing the flags representing the standard DOS file attributes, using the format shown in Table 10.32.

  • Date/Time of last change. The date and time that the file was created or last modified.

  • File size. The size of the file, in bytes.

  • Link to start cluster. The number of the cluster in the partition where the beginning of the file is stored. To learn more about clusters, see the section "Clusters (Allocation Units)," in this chapter.

Other information exists that a folder does not contain about a file. This includes where the rest of its clusters in the partition are located and whether the file is contiguous or fragmented. This information is contained in the FAT.

Two basic types of directories exist: the root directory (also called the root folder) and subdirectories (also called folders). Any given volume can have only one root folder. The root folder is always stored on a disk in a fixed location immediately following the two copies of the FAT. Root folders vary in size because of the different types and capacities of disks, but the root folder of a given disk is fixed. Using the FORMAT command creates a root folder that has a fixed length and can't be extended to hold more entries. The root folder entry limits are shown in Table 10.29. Subfolders are stored as files in the data area of the disk and can grow in size dynamically; therefore, they have no fixed length limits.

Table 10.29. Root Folder Entry Limits

Drive Type

Maximum Root Folder Entries

Hard disk

512

1.44MB floppy disk

224

2.88MB floppy disk

448

Jaz and Zip

512

LS-120 and LS-240

512


Every folder, whether it is the root folder or a subfolder, is organized in the same way. Entries in the folder database store important information about individual files and how files are named on the disk. The folder information is linked to the FAT by the starting cluster entry. In fact, if no file on a disk were longer than one single cluster, the FAT would be unnecessary. The folder stores all the information needed by DOS to manage the file, with the exception of the list of clusters the file occupies other than the first one. The FAT stores the remaining information about the other clusters the file occupies.

To trace a file on a disk, use a disk editor, such as the Disk Edit program that comes with the Norton Utilities. Start by looking up the folder entry to get the information about the starting cluster of the file and its size. Then, using the appropriate editor commands, go to the FAT where you can follow the chain of clusters the file occupies until you reach the end of the file. By using the folder and FAT in this manner, you can visit all the clusters on the disk that are occupied by the file. This type of technique can be useful when these entries are corrupted and when you are trying to find missing parts of a file.

FAT folder entries are 32 bytes long and are in the format shown in Table 10.30, which shows the location (or offset) of each field within the entry (in both hexadecimal and decimal form) and the length of each field.

Table 10.30. FAT Folder Format

Offset (Hex)

Offset (Dec)

Field Length

Description

00h

8 bytes

Filename

08h

8

3 bytes

File extension

0Bh

11

1 byte

File attributes

0Ch

12

10 bytes

Reserved (00h)

16h

22

1 word

Time of creation

18h

24

1 word

Date of creation

1Ah

26

1 word

Starting cluster

1Ch

28

1 dword

Size in bytes


Filenames and extensions are left-justified and padded with spaces (which are represented as ASCII 32h bytes). In other words, if your filename is "AL", it is really stored as "AL---------", where the hyphens are spaces. The first byte of the filename indicates the file status for that folder entry, shown in Table 10.31.

Table 10.31. Folder Entry Status Byte (First Byte)

Hex

File Status

00h

Entry never used; entries past this point not searched.

05h

Indicates that the first character of the filename is actually E5h.

E5h

s (lowercase sigma). Indicates that the file has been erased.

2Eh

. (period). Indicates that this entry is a folder. If the second byte is also 2Eh, the cluster field contains the cluster number of the parent folder (0000h, if the parent is the root).

A word is 2 bytes read in reverse order, and a dword is two words read in reverse order .


Table 10.32 describes the FAT folder file attribute byte. Attributes are 1-bit flags that control specific properties of a file, such as whether it is hidden or designated as read-only. Each flag is individually activated ( 1 ) or deactivated ( ) by changing the bit value. The combination of the eight bit values can be expressed as a single hexadecimal byte value; for example, 07h translates to 00000111, and the 1 bits in positions 2, 1, and 0 indicate the file is system, hidden, and read-only.

Table 10.32. FAT Folder File Attribute Byte

Bit Positions 7 6 5 4 3 2 1 0

Hex Value

Description

0 0 0 0 0 0 0 1

01h

Read-only file

0 0 0 0 0 0 1 0

02h

Hidden file

0 0 0 0 0 1 0 0

04h

System file

0 0 0 0 1 0 0 0

08h

Volume label

0 0 0 1 0 0 0 0

10h

Subfolder

0 0 1 0 0 0 0 0

20h

Archive (updated since backup)

0 1 0 0 0 0 0 0

40h

Reserved

1 0 0 0 0 0 0 0

80h

Reserved

Examples

0 0 0 0 0 1 1 1

07h

System, hidden, read-only

0 0 1 0 0 0 0 1

21h

Read-only, archive

0 0 1 1 0 0 1 0

32h

Hidden, subfolder, archive

0 0 1 0 0 1 1 1

27h

Read-only, hidden, system, archive


Note

The ATTRIB command can be used to change file attributes. In the Windows GUI, you can also use the properties sheet for a file or folder to change the attributes. The archive bit changes automatically when a file is backed up or changed.


FAT File System Errors

File system errors can, of course, occur because of hardware problems, but you are more likely to see them result from software crashes and improper system handling. Turning off a system without shutting down Windows properly, for example, can result in errors that cause clusters to be incorrectly listed as in use when they are not. Some of the most common file system errors that occur on FAT partitions are described in the following sections.

Lost Clusters

Probably the most common file system error, lost clusters are clusters the FAT designates as being in use when they actually are not. Most often caused by an interruption of a file system process due to an application crash or a system shutdown, for example, the FAT entry of a lost cluster might contain a reference to a subsequent cluster. However, the FAT chain stemming from the folder entry has been broken somewhere along the line.

Lost clusters appear in the file structure as shown in Table 10.33.

Table 10.33. Lost Clusters in a File Structure

Folder

Name

Starting Cluster

Size

(no entry)

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1002

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

Cluster available

...

...

...

65526

Last cluster available


The operating system sees a valid chain of clusters in the FAT but no corresponding folder entry to back it up. Programs that are terminated before they can close their open files typically cause this. The operating system usually modifies the FAT chain as the file is written, and the final step when closing is to create a matching folder entry. If the system is interrupted before the file is closed (such as by shutting down the system improperly), lost clusters are the result. Disk repair programs check for lost clusters by tracing the FAT chain for each file and subfolder in the partition and building a facsimile of the FAT in memory. After compiling a list of all the FAT entries that indicate properly allocated clusters, the program compares this facsimile with the actual FAT. Any entries denoting allocated clusters in the real FAT that do not appear in the facsimile are lost clusters because they are not part of a valid FAT chain.

The utility typically gives you the opportunity to save the data in the lost clusters as a file before it changes the FAT entries to show them as unallocated clusters. If your system crashed or lost power while you were working with a word processor data file, for example, you might be able to retrieve text from the lost clusters in this way. When left unrepaired, lost clusters are unavailable for use by the system, reducing the storage capacity of your drive.

The typical choices you have for correcting lost clusters are to assign them a made-up name or zero out the FAT entries. If you assign them a name, you can at least look at the entries as a valid file and then delete the file if you find it useless. The CHKDSK and SCANDISK programs are designed to fix lost clusters by assigning them names starting with FILE0001.CHK . If more than one lost chain exists, sequential numbers following the first one are used. The lost clusters shown earlier could be corrected by CHKDSK or SCANDISK as shown in Table 10.34.

Table 10.34. Finding Lost Clusters

Folder

Name

Starting Cluster

Size

FILE0001.CHK

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1002

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

Cluster available

...

...

...

65526

Last cluster available


As you can see, a new entry was created to match the FAT entries. The name is made up because there is no way for the repair utility to know what the original name of the file might have been.

Cross-Linked Files

Cross-linked files occur when two folder entries improperly reference the same cluster in their Link to Start Cluster fields. The result is that each file uses the same FAT chain. Because the clusters can store data from only one file, working with one of the two files can inadvertently overwrite the other file's data.

Cross-linked files would appear in the file structure as shown in Table 10.35.

Table 10.35. Cross-Linked Files

Folder

Name

Starting Cluster

Size

USCONST.TXT

1000

4

PLEDGE.TXT

1002

2

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

1002

In use, points to next cluster

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

Cluster available

...

...

...

65526

Last cluster available


In this case, two files claim ownership of clusters 1002 and 1003, so these files are said to be cross-linked on 1002. When a situation such as this arises, one of the files typically is valid and the other is corrupt, being that only one actual given set of data can occupy a given cluster. The normal repair is to copy both files involved to new names, which duplicates their data separately in another area of the disk, and then delete all the cross-linked files. Deleting them all is important because by deleting only one of them, the FAT chain is zeroed, which further damages the other entries. Then, you can examine the files you copied to determine which one is good and which is corrupt.

Detecting cross-linked files is a relatively easy task for a disk repair utility because it must examine only the partition's folder entries and not the file clusters themselves . However, by the time the utility detects the error, the data from one of the two files is probably already lostalthough you might be able to recover parts of it from lost clusters.

Invalid Files or Folders

Sometimes the information in a folder entry for a file or subfolder can be corrupted to the point at which the entry is not just erroneous (as in cross-linked files) but invalid. The entry might have a cluster or date reference that is invalid, or it might violate the rules for the entry format in some other way. In most cases, disk repair software can correct these problems, permitting access to the file.

FAT Errors

As discussed earlier, accessing its duplicate copy can sometimes repair a corrupted FAT. Disk repair utilities typically rely on this technique to restore a damaged FAT to its original state, as long as the mirroring process has not corrupted the copy. FAT32 tables are more likely to be repairable because their more advanced mirroring capabilities make the copy less likely to be corrupted.

An example of a damaged FAT might appear to the operating system as shown in Table 10.36.

Table 10.36. Damaged FAT

Folder

Name

Starting Cluster

Size

USCONST.TXT

1000

4

FAT16 File Allocation Table

FAT Cluster #

Value

Meaning

00002

First cluster available

...

...

...

00999

Cluster available

01000

1001

In use, points to next cluster

01001

Cluster available

01002

1003

In use, points to next cluster

01003

FFFFh

End of file

01004

Cluster available

...

...

...

65526

Last cluster available


This single error would cause multiple problems to appear. The file USCONST.TXT would now come up as having an allocation errorin which the size in the folder no longer matches the number of clusters in the FAT chain. The file would end after cluster 1001 in this example, and the rest of the data would be missing if you loaded this file for viewing. Also, two lost clusters would exist; that is, 1002 and 1003 appear to have no folder entry that owns them. When multiple problems such as these appear, a single incident of damage is often the cause. The repair in this case could involve copying the data from the backup FAT back to the primary FAT, but in most cases, the backup is similarly damaged. Normal utilities would truncate the file and create an entry for a second file out of the lost clusters. You would have to figure out yourself that they really belong together. This is where having knowledge in data recovery can help over using automated utilities that can't think for themselves.




Upgrading and Repairing Microsoft Windows
Upgrading and Repairing Microsoft Windows (2nd Edition)
ISBN: 0789736950
EAN: 2147483647
Year: 2005
Pages: 128

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net