File Allocation Table (FAT)
possible values
FAT 12 |
FAT 16 |
FAT 32 |
meaning |
|
|
|
|
0 |
0 |
0 |
unused cluster |
|
|
|
|
3 – 0xFEF |
3 – 0xFFEF |
3 – 0xFFFFFEF |
number of the next |
|
|
|
cluster of the file |
|
|
|
|
0xFF0 – 0xFF6 |
0xFFF0 – 0xFFF6 |
0xFFFFFFF0 – |
reserved cluster |
|
|
0xFFFFFFF6 |
|
|
|
|
|
0xFF7 |
0xFFF7 |
0xFFFFFFF7 |
Bad cluster |
|
|
|
|
0xFF8 – 0xFFF |
0xFFF8 – 0xFFFF |
0xFFFFFFF8 – |
End of file |
|
|
0xFFFFFFFF |
EOF |
|
|
|
|
26
FAT-Chaining
from the directory entry we get the startcluster which is the entry point for the FAT table
Test.txt ………………… 249
Startcluster
In the FAT we will find the rest of the needed clusters
0
249 678
355 EOF
678 355
27 |
FAT |
FAT-Chaining
from the directory entry we get the startcluster which is the entry point for the FAT table
Test.txt ………………… 249
Startcluster
In the FAT we will find the rest of the needed clusters
0
249 EOF
355
678
27 |
FAT |
47
ISEC 2010 – Cybercrime Investigation Training
File Allocation Table
EOF
The first two clusters are reserved
cluster 2 is the |
|
beginning of the |
|
data area |
48 |
|
EOF
File Allocation Table
4 |
5 |
EOF |
Fat-entries for a file which needs 3
clusters.
49
File |
Allocation |
Table |
|
no |
|
free? |
yes |
|
EOF |
4 |
5 |
EOF |
9 |
EOF |
11 |
EOF |
EOF |
|
|
|
|
|
The next file needs 3 clusters. It |
|||
|
|
|
|
|
begins in the first free cluster. |
|
||
50
File |
Allocation |
Table |
|
|
|
|
|
|
|
EOF |
4 |
5 |
EOF |
9 |
EOF |
EOF |
11 |
EOF |
EOF |
directory structure
Name |
Cluster |
Length |
Accessed |
Written |
Created |
.
51
File |
Allocation |
Table |
|
|
|
|
|
|
|
EOF |
4 |
5 |
EOF |
9 |
EOF |
EOF |
11 |
EOF |
EOF |
directory structure
Name |
Cluster |
Length |
Accessed |
Written |
Created |
.
..
52
File |
Allocation |
Table |
|
|
|
|
|
|
|
EOF |
4 |
5 |
EOF |
9 |
EOF |
EOF |
11 |
EOF |
EOF |
1 Cluster = 1024 Bytes
|
directory structure |
|
|
|||||
Name |
|
|
Cluster |
Length |
Accessed |
|
Written |
Created |
. |
|
|
|
|
|
|
|
|
.. |
|
|
|
|
|
|
|
|
Test.txt |
|
2 |
575 |
15/01/00 |
|
15/01/00 |
15/05/00 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
53