File Systems

File systems describe the records and indexes that an Operating System (Windows , Linux) use to retrieve and store data on the hard drive. Before we talk about the simplest filesystem FAT it is important to note all windows based hard drives contain 2 crucial areas on the Hard drive the Master Boot record and the Partition table.

MBR

The first sector on the disk is the Master Boot Record

Structure of a modern standard MBR
Address Description Size in bytes
Hex Dec
+000h +0 Bootstrap code area (part 1) 218
+0DAh +218 0000h Disk timestamp3][b] (optional, MS-DOS 7.1-8.0 (Windows 95B/98/98SE/ME), alternatively can serve as OEM loader signature with NEWLDR) 2
+0DCh +220 original physical drive (80hFFh) 1
+0DDh +221 seconds (0-59) 1
+0DEh +222 minutes (0-59) 1
+0DFh +223 hours (0-23) 1
+0E0h +224 Bootstrap code area (part 2, code entry at +000h) 216(or 222)
+1B8h +440 32-bit disk signature Disk signature (optional, UEFI, Windows NT/2000/Vista/7 and other OSes) 4
+1BCh +444 0000h 2
+1BEh +446 Partition entry #1 Partition table(for primary partitions) 16
+1CEh +462 Partition entry #2 16
+1DEh +478 Partition entry #3 16
+1EEh +494 Partition entry #4 16
+1FEh +510 55h Boot signature[a] 2
+1FFh +511 AAh
Total size: 218 + 6 + 216 + 6 + 4*16 + 2 512

You can have 4 primary partitions on a FAT32 drive and we typically see portable hard drives formatted this way as most common operating systems can read and write to FAT32 while more modern and robust file systems such as NTFS , HFS & EXT4 cannot.

The layout of a FAT32 partition contains the following records.

The Boot Sector which is the first sector of the partition

This usually contains the operating system’s boot loader code.

The FAT Region.

FAT32 contains the Root Directory Table which keeps the following info about a file or directory it’s name , extension , creation & modified date , filesize and the location of it’s first cluster in the FAT.

The actual data for a file is comprised of a linked list of clusters stored in the File Allocation Table each cluster contains either the next cluster in the chain or an end of file marker.

Data Recovery

It is common for these data structure to become corrupt if for example the partition table is corrupted the drive will appear to need formatting. If any of the File Allocation Table becomes corrupt your files will appear to be missing.

Share Button