Windows 98 SE (Second Edition) FAT32 Example


Introduction

This page contains a discussion of FAT entries and clusters in conjunction with the FAT32 section of the Windows 98SE Boot Sector. Included is the first sector of the FAT for the same hard drive discussed there. The hard drive was formatted as FAT32 which works the same as FAT16 except that FAT32 consists of 4-byte entries whereas FAT16 uses 2-byte entries. This portion of the FAT is contained in the last 31 sectors of the first track of the boot partition and is the beginning of the first FAT.

First FAT

The first sector of the first FAT is shown below. The offsets given below are from the beginning of the track on which the boot sectors reside. Offset 4100h is the first entry in the first FAT.

FAT32 - Hex view

OFFSET      0  1  2  3  4  5  6  7    8  9  A  B  C  D  E  F   0123456789ABCDEF
-------------------------------------------------------------------------------
0000:4100  F8 FF FF 0F FF FF FF 0F - FF FF FF 0F 9B 0C 00 00   ................
0000:4110  FF FF FF 0F 06 00 00 00 - 07 00 00 00 08 00 00 00   ................
0000:4120  09 00 00 00 0A 00 00 00 - 0B 00 00 00 0C 00 00 00   ................
0000:4130  0D 00 00 00 0E 00 00 00 - 0F 00 00 00 10 00 00 00   ................
0000:4140  11 00 00 00 12 00 00 00 - 13 00 00 00 14 00 00 00   ................
0000:4150  15 00 00 00 16 00 00 00 - 17 00 00 00 18 00 00 00   ................
0000:4160  19 00 00 00 1A 00 00 00 - 1B 00 00 00 1C 00 00 00   ................
0000:4170  1D 00 00 00 1E 00 00 00 - 1F 00 00 00 20 00 00 00   ............ ...
0000:4180  21 00 00 00 22 00 00 00 - 23 00 00 00 24 00 00 00   !..."...#...$...
0000:4190  25 00 00 00 26 00 00 00 - 27 00 00 00 28 00 00 00   %...&...'...(...
0000:41A0  29 00 00 00 2A 00 00 00 - 2B 00 00 00 2C 00 00 00   )...*...+...,...
0000:41B0  2D 00 00 00 2E 00 00 00 - 2F 00 00 00 30 00 00 00   -......./...0...
0000:41C0  31 00 00 00 32 00 00 00 - 33 00 00 00 34 00 00 00   1...2...3...4...
0000:41D0  35 00 00 00 36 00 00 00 - 37 00 00 00 38 00 00 00   5...6...7...8...
0000:41E0  39 00 00 00 3A 00 00 00 - 3B 00 00 00 3C 00 00 00   9...:...;...<...
0000:41F0  3D 00 00 00 3E 00 00 00 - 3F 00 00 00 40 00 00 00   =...>...?...@...
0000:4200  41 00 00 00 42 00 00 00 - 43 00 00 00 44 00 00 00   A...B...C...D...
0000:4210  45 00 00 00 46 00 00 00 - 47 00 00 00 48 00 00 00   E...F...G...H...
0000:4220  49 00 00 00 4A 00 00 00 - 4B 00 00 00 4C 00 00 00   I...J...K...L...
0000:4230  4D 00 00 00 4E 00 00 00 - 4F 00 00 00 50 00 00 00   M...N...O...P...
0000:4240  51 00 00 00 66 01 00 00 - FF FF FF 0F FF FF FF 0F   Q...f...........
0000:4250  FF FF FF 0F A4 00 00 00 - FF FF FF 0F 58 00 00 00   ............X...
0000:4260  59 00 00 00 5A 00 00 00 - 5B 00 00 00 5C 00 00 00   Y...Z...[...\...
0000:4270  5D 00 00 00 5E 00 00 00 - 5F 00 00 00 60 00 00 00   ]...^..._...`...
0000:4280  61 00 00 00 62 00 00 00 - 63 00 00 00 64 00 00 00   a...b...c...d...
0000:4290  65 00 00 00 66 00 00 00 - 67 00 00 00 68 00 00 00   e...f...g...h...
0000:42A0  FF FF FF 0F 6A 00 00 00 - 6B 00 00 00 6C 00 00 00   ....j...k...l...
0000:42B0  FF FF FF 0F 6E 00 00 00 - 6F 00 00 00 70 00 00 00   ....n...o...p...
0000:42C0  FF FF FF 0F 72 00 00 00 - 73 00 00 00 74 00 00 00   ....r...s...t...
0000:42D0  75 00 00 00 76 00 00 00 - 77 00 00 00 78 00 00 00   u...v...w...x...
0000:42E0  79 00 00 00 7A 00 00 00 - FF FF FF 0F 7C 00 00 00   y...z.......|...
0000:42F0  7D 00 00 00 7E 00 00 00 - 7F 00 00 00 80 00 00 00   }...~...........

The examples below use that portion of the FAT shown above.

Discussion of FAT32 entries.

In order to calculate the location of each FAT entry, multiply the FAT entry number by 4 (since there are 4 bytes per entry) and add 4100h since that is the location of the beginning of the FAT shown above. Thus FAT entry 0 is located at 0000:4100, while FAT entry 55h is located at 4 * 55h + 4100h = 154h + 4100h = 4254h (0000:4254). Since the root directory entries are not shown, there is no way to know which files correspond to the above FAT entries nor where each file begins.

The first two entries are the special values as discussed in Reserved FAT32 Entries.

FAT32 entry 0 is F8FFFF0F = 0FFFFFF8h = Media Descriptor byte 0xF8
FAT32 entry 1 is FFFFFF0F = 0FFFFFFFh = EOC mark

The next few entries are:

FAT32 entry 2 is FFFFFF0F = 0FFFFFFFh = EOC mark (Cluster 2 is last cluster in chain).
FAT32 entry 3 is 9B0C0000 = 00000C9Bh = cluster # of next cluster in chain.
FAT32 entry 4 is FFFFFF0F = 0FFFFFFFh = EOC mark (Cluster 4 is last cluster in chain).
FAT32 entry 5 is 06000000 = 00000006h = cluster # of next cluster in chain.
where we can see that cluster # C9Bh follows cluster # 3h and cluster # 6h follows cluster # 5h. The EOC mark for Cluster 2, which the BPB indicated was the start of the root directory, indicates that the root directory only occupies one cluster. Since the BPB indicated 8 sectors per cluster and 512 bytes per sector, and all FAT32 directory entries are 32 bytes in length, there is currently a maximum of 128 directory entries. If more than 128 directory entries are created, then entry 2 above would indicate the cluster # of the next cluster of the root directory. This overcomes the old limit, usually 512, of root directory entries on a hard drive (floppy disks have different limits) since the size of the root directory was fixed during formatting.

Example of following the cluster chain.

From entry 5 above we see that the next cluster in the chain for this file is cluster #6h. This also indicates that FAT entry 6h will contain the cluster number for the next cluster. This particular cluster chain is contiguous up to cluster # 51h. FAT entry 51h however indicates that the next cluster is cluster #166h and FAT entry #166h will contain the next cluster number in the chain.

Second example of following the cluster chain.

FAT32 entry 55h is at offset 154h (0000:4254) of the FAT and contains the value A4000000 which is 000000A4h. Thus the next cluster in the chain for this file (or directory) is Cluster # A4h. To find the next cluster after A4h, look at FAT entry A4h which is at offset 290h (0000:4390, i.e. 4 * A4h + 4100h) and contains the value A5000000 which is 000000A5h and the next cluster in the chain. Thus the chain of clusters can be found by following the FAT entries until an EOC mark is encountered which marks the end of the chain.

Third example of following the cluster chain.

FAT32 entry 57h is at offset 15Ch (0000:425C) of the FAT and contains the value 58000000 which is 00000058h. Thus the next cluster in the chain for this file (or directory) is Cluster # 58h. FAT entry 58h contains 59h, the next cluster number and also the FAT entry containing the next cluster number in the chain. The following FAT entries and associated clusters are contiguous. FAT entry 68h, at offset 1A0h (0000:42A0), in the chain contains the value FFFFFF0F which is 0FFFFFFFh and is the EOC mark indicating that cluster # 68h is the last cluster in the chain.

FAT as a linked list.

From the above it can be seen that it is relatively simple to follow the FAT entries to construct the cluster chain for any file. However it is obvious that this linked list can only be followed in one direction. Reconstructing the cluster chain in the opposite direction could be done only by tediously searching the FAT for each link in the chain, unless all the links just happened to be contiguous.

Go back to the FAT32 section of Windows 98SE Boot Sector.


MBR/Boot Index

Home Page

This page was created on 21 June 2001, last updated on 27 April 2003.