FileSystem FAT


FAT
FAT12: Developed 1977 (MS Disk BASIC)
FAT16: Developed 1987 (MS-DOS 3.31)
FAT32: Developed 1996 (Win95 OSR2)
exFAT

refer
http://www.c-jump.com/CIS24/Slides/FAT/lecture.html  

ps:
FAT12 is most suitable for very small volumes, and is used on floppy disks and hard disk partitions smaller than about 16 MB 
refer
http://www.pcguide.com/ref/hdd/file/partSizes-c.html

..........................................................................................................

FAT32

limit of FAT32
limit of volume size is 2TB
limit of a file size is 4GB

cluster
windows 的磁碟單位
FAT32預設是1個cluster佔用4個sector(2KB)
ex:
若檔案為125KB,那會需要62.5個cluster.因此要佔用63個cluster
而63個cluster佔用就=256個sector被佔用

ps:
若檔案小於1個cluster,其餘的空間也無法使用,這些空間稱為slack space

...


FAT Partition boot sector
first sector in the partition
structure as below
 3byte, jump instruction
 8byte, OEM name in text
 25byte, BIOS parameter block
 26byte, Extended BIOS parameter block
 448byte, Bootstrap Code
 2 byte, end of sector marker

...

FAT layout
Root directory(directory entries)
File allocation table(FAT1)
File allocation table for backup(FAT2)

FAT ID of FAT1
0x0000:unused/unallocated cluster
0xFFF7: bad cluster

0x:FFFB-0xFFFF: Last cluster in a file
ps:
ID is 1word(2byte)
ps:
計算有多少last cluster可知道有幾個檔案

structure of root directory 
[0] 1byte, status(0xe5=delete,0x00=unallocated)
[0-10] file name in ASCII
[11] file attribute
[12] reserved
[13] create time(tenths of second)
[14-15] create time(hours,minutes,seconds)
[16-17] created day
[18-19] accessed day
[20-21] high 2 bytes of first cluster address 
[22-23] written time(hours,minutes,seconds)
[24-25] written day
[26-27] low 2 bytes of first cluster address , 記錄資料那從裡開始記錄
[28-31] 4byte, size of file, 0=directory
ps:
FAT沒有accessed time
filename格式為"6char"+"~1.副檔名", 若有重覆則增加序號為"6char"+"~2.副檔名"
ps:
make file disappear, set first character to 0xE5 or 0x00


file attribute
Flag = Value, Description, Essential
0000 0001 = 0x01, Read only, No
0000 0010 = 0x02, Hidden file, No
0000 0100 = 0x04, System file, No
0000 1000 = 0x08, Volume label, Yes
0000 1111 = 0x0f, Long file name, Yes
0001 0000 = 0x10, Directory, Yes
0010 0000 = 0x20, Archive, No

...

Lost clusters
以下兩情況同時發生時表示cluster遺失
OS does not allocate cluster to any file, ex:a file is deleted from the directory listing
OS marks cluster as used, ex:FAT still shows the clusters allocated to the file

... 

chkdisk
檢查目錄結構和 FAT 不一致性的工具
可檢查以下:
 無效的指標到資料區域
 目錄項目中的不正確的檔案屬性
 損壞,因此無法檢查一或多個路徑的目錄的一部份
 整個目錄,讓該目錄中所包含的檔案無法存取的損壞
 在 FAT 損壞的磁碟磁扇區
 Invalid cluster numbers in the FAT(無效的叢集在FAT)
 Lost Cluster(遺失叢集):叢集識別未被指派至檔案
 交互連結的檔案相同的叢集 (超過一個檔案已被指派相同的叢集)
refer
(https://support.microsoft.com/zh-tw/kb/71609)



 

 

2015-10-18 12:55:42發表 2015-10-18 12:58:13修改   

數據分析
程式開發
計算機組織與結構
資料結構與演算法
Database and MySql
manage tool
windows

unix-like
linux service
network
network layer3
network layer2
network WAN
network service
作業系統
數位鑑識
資訊安全解決方案
資訊安全威脅
Cisco security
Cisco network
Cisco layer3
Cisco layer2



  登入      [牛的大腦] | [單字我朋友] Powered by systw.net