Searching file in FAT16 partition
  data recovery   ISO Certified Recovery Experts     
  Data Recovery Services disk recovery Data Recovery Service services data recovery Hard Disk Recovery
 
 
 
 
Searching file in FAT16 partition


Let's see a boot sector (start sector is DBR) in FAT16 after advanced format. The OEM mark is MSWIN5.0.



From the chart we can see, the parameters of file system are all record in BPB parameter table of DBR; with the parameter table, system can locate FAT, FDT and DATA. The meaning of the parameters is shown in the following chart:

Offset Length  
00 3 JMP instruction; jump to boot application. Followed by a waste operation (90,NOP) (not belongs to BPB)
03 8 OEM mark, file system mark and version (not belongs to BPB)
0B 2 Byte number of each sector, like 512, recording size of sector
0D 1 Sector number of each cluster, like 4, recording cluster size, that is how many sectors a cluster is composed of
0E 2 reserved sector number in DOS: like 2; reserved sector number has something with location of FAT, FDT and DATA; the low version system is 1, however, it can be other by adjusting.
10 1 FAT number: like 2; number of FAT, usually is 2.
11 2 Boot record number: like 512; Actually it is the maximum of directory entrys number early root directory can contain, which is also adjustable.
13 2 Sector (smaller than 32MB): 0; total number of sectors. It records all partitions smaller than 32MB. It is only 16 bit, so the maximum is 32MB. For partitions bigger than 32MB, it records in 20~23byte with 32 bit.
15 1 Medium description (hexadecimal): F8H
16 2 Sector number of each FAT: like 235; length of FAT table, taking sector as a unit, the number of sectors is integral.
18 2 Sector number of each track: 63; logic parameter
1A 2 Head number: 255; logic parameter
1C 4 Hidden sector; 63; sector number from HD LBA=0 to DBR
20 4 Sector (bigger than 32MB): 240912; total number of sectors in the partition, partition size
24 1 BIOS device (hex, HD=8X): 80
25 1 (idle): 0
26 1 Extend boot mark(29h): 29h
27 4 Volume serial number (hex): 3A E2 60 10; random serial number
2B 11 Volume label: FAT16; there is a volume label for each logic driver, it is only an identifier set by users. Here in order to distinguish partitions, it is assigned as FAT16, the same as file system.
36 8 File system: FAT 16; clear file system


Another way to express:



We have known that system can divide all sectors located in the same cylinder into a partition with cylinder as the division surface in partition. System manages partition in 5 regions. There is no special rule between the 5 regions and partition, thus the number of DATA sectors is probably not a integer; in other words, when executing the cluster management of DATA, the last several sectors do not rightly form a cluster. So the system can not execute cluster management to these sectors. By WinHex, we call them residual sectors. Now let's see how system divide and organize the 5 regions:

Firstly, when formatting, system will calculate that how many sectors should be covered by FAT, that is how many sectors should be allocated to FAT. As the following chart, we have known the number of sum sectors, reserved sectors and covered sectors by FDT, thus we can calculate the number of FAT sectors and DATA sectors.

Obviously, FAT sector number has a close relationship with DATA sector number. Because the more FAT occupies, the less DATA does, thus there need not so large FAT; while FAT reduces, DATA enlarges, and FAT should be larger; so there is a balance point. According to the balance point, we can get the most reasonable assignment (the most optimal principle), thus getting a formula to calculate the FAT length:

The formula is a quite complex one, here is just an example. Because calculates manually quite complex, here does not calculate the best assignment, only carries on the confirmation. Actually when some systems formatted small partition, because FAT is small, directly uses the sector total and each cluster of sector number to calculate FAT is also a good and convenient way.

FAT16 partition example:

FAT= {[(240912-1-235*2-32)/4]*2+4}/512=234.7822, take an integer 235. Then there is a problem, if the FAT sector number is too big, the manageable DATA sectors certainly surpasses the actual size of DATA region. Will it write in the data to the outside the DATA region? Of course, system will not have this problem, for it does not use all FAT last sectors but uses part that adapts with DATA. According to the computation, we can obtain the relations among regions as following:



In addition, please note that in practice, the length of FAT often does not meet the optimal principle. If thus, we need just manage according to the actual size, for it does not affect much.

Reserved sectors, FAT and FDT are recorded in DBR. According to these parameters the entrance of each region can be determined. The FDT records parameters of sub-directory or files under the root directory. According to these parameters, it may determine the first cluster of file or directory in DATA region and the start point of cluster chain in FAT. Then, make use of the cluster chain in FAT to track the file or directory in DATA until the file or directory ends. Thus we can know the whole file/directory storage situation in disk. Thereto, in FAT, there are different situations in file registration, such as backwards, forwards and cross record; this may be have something with the order that the system finds the free cluster when writing files. Here is an example of a file composed by two clusters:

In practice, system manages files and directories in this way. Also we may see that DATA is a very special region, it only has start and end point; the region itself does not have any relation with the file or directory. DATA only records the data, as for relation among the data, it is explained by FDT and FAT. There are only FDT and FAT as the entrance of DATA region, therefore, FDT and FAT are extremely important to the DATA region. If FDT and FAT are destroyed, it is unable to explain the actual meaning of data in DATA. It is system's responsibility to explain them.

 
Copyright © 1998-2007 Salvage Data Recovery Service