What format fs fat is considered. What to do if data is lost. Organization of the fat file system

Introduction

2.1 FAT16 system

2.2 FAT32 system

2.3 Comparison of FAT16 and FAT32

3.1 NTFS system

3.2 Comparison of NTFS and FAT32

Conclusion

Bibliography

Introduction

Currently, on average, several tens of thousands of files are recorded on one disk. How to understand all this diversity in order to accurately address the file? The purpose of the file system is an effective solution to this problem.

File system from the user's point of view, this is the "space" in which the files are placed. And as a scientific term, it is a way of storing and organizing access to data on information carrier or its section. The presence of a file system allows you to determine the name of the file, where it is located. Since information is stored mainly on disks on IBM PC-compatible computers, the file systems used on them determine the organization of data on disks (more precisely, on logical disks). We will look at the FAT file system.

fat ntfs file system

1. History of creation and general characteristics FAT file system

The FAT (File Allocation Table) file system was developed by Bill Gates and Mark McDonald in 1977 and was originally used in the 86-DOS operating system. In order to achieve portability of programs from the CP/M operating system to 86-DOS, it retained the earlier restrictions on filenames. 86-DOS was later acquired by Microsoft and became the basis for MS-DOS 1.0, released in August 1981. FAT was designed to work with floppy disks smaller than 1 MB, and did not initially support hard disks. FAT currently supports files and partitions up to 2 GB in size.

FAT uses the following file naming conventions:

the name must start with a letter or number and can contain any ASCII character except for space and "/\ :; |=,^*?

The name is up to 8 characters long, followed by a dot and an optional extension up to 3 characters long.

case of characters in file names is not distinguished and is not preserved.

The structure of the FAT partition is shown in Table 1.1 The BIOS parameter block contains the information required by the BIOS about the physical characteristics hard drive. The FAT file system cannot control each sector separately, so it combines adjacent sectors into clusters. This reduces the total number of storage units that the file system has to keep track of. The cluster size in FAT is a power of two and is determined by the size of the volume when formatting the disk (Table 1.2). A cluster is the minimum space a file can occupy. This results in some disk space being wasted. The operating system includes various utilities (DoubleSpace, DriveSpace) designed to compact data on a disk.

Tab. 1.1 - FAT partition structure

Boot sector BIOS Parameter Block (BPB) FATFAT (copy) Root Directory File Area

FAT got its name from the file allocation table of the same name. The file allocation table stores information about logical disk clusters. Each cluster in the FAT has a separate entry that shows whether it is free, busy with file data, or marked as bad (corrupted). If the cluster is occupied by a file, then the address of the cluster containing the next part of the file is indicated in the corresponding entry in the file allocation table. Because of this, FAT is called a linked list file system. The original version of FAT, developed for DOS 1.00, used a 12-bit file allocation table and supported partitions up to 16 MB in size (a maximum of two FAT partitions can be created in DOS). To support hard drives larger than 32 MB, the FAT bit depth has been increased to 16 bits, and the cluster size to 64 sectors (32 KB). Since each cluster can be assigned a unique 16-bit number, the FAT supports a maximum of 216, or 65536 clusters per volume.

Table 1.2 - Cluster sizes

Partition sizeCluster sizeFAT type< 16 Мб4 КбFAT1216 Мб - 127 Мб2 КбFAT16128 Мб - 255 Мб4 КбFAT16256 Мб - 511 Мб8 КбFAT16512 Мб - 1023 Мб16 КбFAT161 Гб - 2 Гб32 КбFAT16

Because the boot record is too small to store the system file search algorithm on disk, the system files must be in a specific location for the boot record to find them. The fixed position of system files at the beginning of the data area imposes a hard limit on the size of the root directory and the file allocation table. As a result, the total number of files and subdirectories under the root directory on a FAT drive is limited to 512.

Each file and subdirectory in the FAT has a 32-byte directory entry that contains the file name, its attributes (archive, hidden, system, and read-only). ), date and time of creation (or addition of recent changes), as well as other information (Table 1.3).

Table 1.3 - Catalog elements

The FAT file system always fills free place on the disc sequentially from beginning to end. When creating a new file or expanding an existing one, it looks for the very first free cluster in the file allocation table. If in the course of work some files were deleted, while others changed in size, then the resulting empty clusters will be scattered across the disk. If the clusters containing the file's data are not in a row, then the file is fragmented. Heavily fragmented files significantly reduce work efficiency, since the read / write heads, when searching for the next file record, will have to move from one area of ​​\u200b\u200bthe disk to another. Operating systems that support FAT typically include special utilities disk defragmentation designed to improve the performance of file operations.

Another disadvantage of FAT is that its performance is highly dependent on the number of files stored in a single directory. With a large number of files (about a thousand), the operation of reading the list of files in the directory may take several minutes. This is due to the fact that in FAT a directory has a linear unordered structure, and the names of files in directories are in the order they were created. As a result, the more entries in the directory, the slower programs work, since when searching for a file, it is necessary to look through all the entries in the directory sequentially. Since FAT was originally designed for the single-user DOS operating system, it does not provide for storing information such as owner information or file / directory access permissions. It is the most common file system and most modern operating systems support it to one degree or another. Due to its versatility, FAT can be used on volumes that work with different OS.

Although there are no barriers to using any other file system when formatting floppy disks, most operating systems use FAT for compatibility. This can be partly explained by the fact that the simple FAT structure requires less space to store service data than other systems. The advantages of other file systems become noticeable only when they are used on media larger than 100 MB.

It should be noted that FAT is a simple file system that does not prevent file corruption due to abnormal computer shutdown. Operating systems that support FAT include special utilities that check the structure and correct inconsistencies in the file system.

2. Characteristics of the FAT16 and FAT32 file systems and their comparison

.1 FAT16 system

The FAT 16 file system, which is the main file system for DOS, Windows 95⁄98⁄Me, Windows NT⁄2000⁄XP operating systems, and is also supported by most other systems. FAT 16 is a simple file system designed for small drives and simple structures directories. The name comes from the name of the file organization method - File Allocation Table. This table is placed at the beginning of the disk. The number 16 means that this file system is 16-bit - 16 bits are used to address clusters. The operating system uses the File Allocation Table to find a file and determine the clusters that file occupies on the hard drive. In addition, the Table contains information about free and defective clusters. To make it easier to comprehend the FAT16 file system, imagine the table of contents of a book and how you work with this table of contents, that's exactly how the operating system works with FAT 16.

To read a file, the operating system must find the entry in the folder by the file name and read the number of the first cluster of the file. The first cluster represents the beginning of the file. Then it is necessary to read the FAT element corresponding to the first cluster of the file. If the element contains a label - the last one in the chain, then there is no need to look for anything further: the entire file fits in one cluster. If the cluster is not the last one, then the table element contains the number of the next cluster. The contents of the next cluster must be read after the first one. When the last cluster in the chain is found, then if the file does not occupy the entire cluster, it is necessary to cut off the extra bytes of the cluster. Excess bytes are trimmed according to the length of the file stored in the folder entry.

To write a file, the operating system must perform the following sequence of actions. A file description is created in a free folder element, then a free FAT element is searched for, and a link to it is placed in the folder entry. The first cluster described by the found FAT element is occupied. This FAT element is filled with the number of the next cluster or the sign of the last cluster in the chain.

The operating system acts in such a way as to collect chains from neighboring clusters in ascending order. It is clear that access to successive clusters will be much faster than to clusters randomly scattered across the disk. In this case, already occupied and marked in the FAT as bad clusters are ignored.

In the FAT16 file system, 16 bits are reserved for the cluster number. Therefore, the maximum number of clusters is 65525 and the maximum cluster size is 128 sectors. In this case, the maximum size of partitions or disks in FAT16 is 4.2 gigabytes. When logically formatting a disk or partition, the operating system tries to use the minimum cluster size that will result in a maximum of 65525 clusters. Obviously, the larger the partition size, the larger the cluster size should be. Many operating systems do not work correctly with a 128 sector cluster. As a result, the maximum size of a FAT16 partition is reduced to 2 gigabytes. Typically, the larger the cluster size, the greater the wasted disk space. This is because the last cluster occupied by the file is only partially filled. For example, if a 17 KB file is written to a partition with a 16 KB cluster size, then the file will take up two clusters, with the first cluster being full, the second cluster writing only 1 KB of data, and the remaining 15 KB of space in the second cluster remaining unused. full and will not be writable by other files. If a large number of small files are written to large disks, then the loss of disk space will be significant. The following table 2.1 provides information about the possible wasted disk space for different partition sizes.

Tab. 2.1.1 - Loss of disk space

Partition SizeCluster SizeDisk Space Wasted127MB2Kb2%128-255MB4Kb4%256-511MB8Kb10%512-1023MB16Kb25%1024-2047MB32Kb40%2048-4096MB64Kb50%

There are two ways to reduce wasted disk space. The first is partitioning disk space into small partitions with a small cluster size. The second is using the FAT32 file system<#"center">2.2 FAT32 system

The FAT32 file system is a newer file system based on the FAT format and is supported by Windows 95 OSR2, Windows 98, and Windows Millennium Edition. FAT32 uses 32-bit cluster IDs, but reserves the upper 4 bits, so the effective cluster ID size is 28 bits. Since the maximum size of FAT32 clusters is 32 KB, FAT32 can theoretically handle 8 terabyte volumes. Windows 2000 limits the size of new FAT32 volumes to 32 GB, although it does support existing larger FAT32 volumes (created on other operating systems). The larger number of clusters supported by FAT32 allows it to manage disks more efficiently than FAT 16. FAT32 can use 512-byte clusters for volumes up to 128 MB.

The FAT 32 file system in Windows 98 is used as the default. This operating system comes with special program converting a disk from FAT 16 to FAT 32. Windows NT and Windows 2000 can also use the FAT file system, and so you can boot your computer from a DOS disk and have full access to all files. However, some of the most advanced features of Windows NT and Windows 2000 are provided by its own NTFS (NT File System) file system. NTFS allows you to create partitions up to 2 TB on a disk (like FAT 32), but, in addition, it has built-in file compression, security and auditing functions that are necessary when working in a network environment. And Windows 2000 implements support for the FAT 32 file system. Windows systems NT starts on a FAT disk, but at the end of the installation, the data on the disk can be converted to NTFS format at the end of the installation.

You can also do this later using the Convert utility. exe that comes with the operating system. A disk partition converted to NTFS becomes inaccessible to other operating systems. To return to DOS, Windows 3.1, or Windows 9x, you need to remove the NTFS partition and create a FAT partition instead. Windows 2000 can be installed on a drive with the FAT 32 and NTFS file system.

The capabilities of FAT32 file systems are much broader than those of FAT16. Its most important feature is that it supports disks up to 2047 GB and works with smaller clusters, thereby significantly reducing the amount of wasted disk space. For example, HDD 2 GB in FAT16 uses 32 KB clusters, and FAT32 uses 4 KB clusters. To maintain compatibility with existing programs, networks, and device drivers wherever possible, FAT32 is implemented with minimal changes to the architecture, APIs, internal data structures, and disk format. But, since the size of the FAT32 table elements is now four bytes, many internal and disk data structures, as well as APIs, had to be revised or extended. Certain APIs on FAT32 drives are blocked to prevent legacy disk utilities from corrupting the contents of FAT32 drives. Most programs will not be affected by these changes. Existing tools and drivers will work on FAT32 drives as well. However, MS-DOS block device drivers (such as Aspidisk.sys) and disk utilities need to be modified to support FAT32. All disk utilities supplied by Microsoft (Format, Fdisk, Defrag, and ScanDisk for real and protected modes) have been redesigned to fully support FAT32. In addition, Microsoft is helping leading vendors of disk utilities and device drivers modify their products to support FAT32. FAT32 is more efficient than FAT16 when working with larger disks and does not require them to be partitioned into 2 GB partitions. Windows 98 necessarily supports FAT16, since it is this file system that is compatible with other operating systems, including third-party companies. In real mode MS-DOS and in safe mode Windows 98, the FAT32 file system is significantly slower than FAT16. Therefore, when running programs in MS DOS mode, it is desirable to include Autoexec. bat or PIF file command to download Smartdrv. exe, which will speed up disk operations. Some older FAT16 programs may report incorrect information about the amount of free or total disk space if it is more than 2 GB. Windows 98 provides new APIs for MS-DOS and Win32 that allow these metrics to be correctly determined.

.3 Comparison of FAT16 and FAT32

Table 2.3.1 - Comparison of FAT16 and FAT32 file systems

FAT16FAT32 Implemented and used by most operating systems (MS-DOS, Windows 98, Windows NT, OS/2, UNIX). On this moment only supported on Windows 95 OSR2 and Windows 98. Very effective for logical drives smaller than 256 MB. Does not work with disks smaller than 512 MB. Supports disk compression, such as the DriveSpace algorithm. Does not support disk compression. Handles a maximum of 65,525 clusters, the size of which depends on the size of the logical drive. Since the maximum cluster size is 32 KB, FAT16 can only handle logical disks up to 2 GB. Able to work with logical drives up to 2047 GB with a maximum cluster size of 32 KB.

The maximum possible file length in FAT32 is 4 GB minus 2 bytes. Win32 applications can open files of this length without special processing. Other applications should use interrupt Int 21h, function 716C (FAT32) with open flag equal to EXTEND-SIZE (1000h).

In the FAT32 file system, 4 bytes are allocated for each cluster in the file allocation table, while in FAT16 - 2 bytes, and in FAT12 - 1.5 bytes.

The upper 4 bits of the 32-bit FAT32 table entry are reserved and do not participate in the formation of the cluster number. Programs that directly read the FAT32 table must mask these bits and prevent them from being changed when new values ​​are written.

So, FAT32 has the following advantages over previous implementations of the FAT file system:

supports drives up to 2 TB;

organizes disk space more efficiently. FAT32 uses smaller clusters (4 KB for drives up to 8 GB), which saves up to 10-15% of space on large drives compared to FAT;

the FAT 32 root directory, like all other directories, is now unlimited, it consists of a chain of clusters and can be located anywhere on the disk;

has higher reliability: FAT32 is able to move the root directory and work with a FAT backup, in addition, the boot record on FAT32 drives has been expanded to include a backup of critical data structures, which means that FAT32 drives are less sensitive to the occurrence of separate bad patches than existing FAT volumes;

programs load 50% faster.

Table 2.3.2 - Comparison of cluster sizes

Disk SizeFAT16 Cluster Size KBFAT32 Cluster Size KB256MB-511MB8Not Supported512MB-1023MB1641024MB-2GB3242GB-8GBNot Supported48GB-16GBNot Supported816GB-32GBNot Supported16More than 32GBNot Supported32

3. Alternative file NTFS system and its comparison with FAT32

3.1 NTFS system

(New Technology File System) is the most preferred file system when working with Windows NT, as it was specially designed for this system. Windows NT includes a convert utility that converts FAT and HPFS volumes to NTFS volumes. In NTFS, the possibilities for managing access to individual files and directories are significantly expanded, a large number of attributes are introduced, fault tolerance is implemented, dynamic file compression tools are implemented, and support for the requirements of the POSIX standard. NTFS allows filenames up to 255 characters long, and it uses the same short name generation algorithm as VFAT. NTFS is self-healing in the event of an OS or hardware failure, so that the disk volume remains available and the directory structure is intact.

Each file on an NTFS volume is represented by an entry in a special file, the MFT (Master File Table). NTFS reserves the first 16 table entries, about 1MB in size, for special information. The first table entry describes directly the main file table itself. It is followed by a mirrored MFT entry. If the first MFT entry is corrupted, NTFS reads the second entry to find a mirrored MFT file whose first entry is identical to the first MFT entry. The location of the MFT data segments and the MFT mirror file is stored in the bootstrap sector. A copy of the bootstrap sector is located at the logical center of the disk. The third MFT entry contains the log file used to restore files. The seventeenth and subsequent entries in the master file table are used by the actual files and directories on the volume.

The transaction log (log file) records all operations that affect the structure of the volume, including the creation of a file and any commands that change the directory structure. The transaction log is used to recover an NTFS volume after a system failure. The entry for the root directory contains a list of files and directories stored in the root directory.

The space allocation scheme on a volume is stored in a bitmap file. The data attribute of this file contains a bitmap, each bit of which represents one volume cluster and indicates whether the given cluster is free or occupied by some file. It also supports a bad cluster file for registering bad areas on a volume and a volume file A containing the volume name, NTFS version, and the bit that is set when the volume is corrupted. Finally, there is a file containing an attribute definition table that defines the types of attributes supported on the volume and whether they can be indexed, restored by system restore, etc. allocates space in clusters and uses 64 bits to number them , which makes it possible to have 264 clusters, each up to 64 KB in size. As in FAT, the cluster size can change, but does not necessarily increase in proportion to the size of the disk. Cluster sizes set by default when formatting a partition are shown in Table 3.1.

Partition size Cluster size< 512 Мб512 байт513 Мб - 1024 Мб (1 Гб) 1 Кб1 Гб - 2 Гб2 Кб2 Гб - 4 Гб4 Кб4 Гб - 8 Гб8 Кб8 Гб - 16 Гб16 Кб16 Гб - 32 Гб32 Кб>32 GB64 KB allows you to store files up to 16 exabytes (264 bytes) and has built-in real-time file compaction. Compression is one of the attributes of a file or directory and, like any attribute, can be removed or set at any time (compression is possible on partitions with a cluster size of no more than 4 KB). When compacting a file, in contrast to the compression schemes used in FAT, per-file compaction is used, so damage to a small area of ​​\u200b\u200bthe disk does not lead to loss of information in other files.

To reduce fragmentation, NTFS always tries to store files in contiguous blocks. This system uses a B-tree directory structure similar to the high-performance HPFS file system, rather than a linked list used in FAT. This makes searching for files in a directory faster because filenames are stored sorted in lexicographic order. was designed as a recoverable file system that uses a transaction processing model. Each I/O operation that changes a file on an NTFS volume is treated as a transaction by the system and can be executed as an indivisible block. When a file is modified by a user, the log file service captures all the information needed to retry or rollback the transaction. If the transaction is completed successfully, the file is modified. If not, NTFS rolls back the transaction.

Despite the presence of protection against unauthorized access to data, NTFS does not provide the necessary confidentiality of stored information. To access the files, it is enough to boot the computer into DOS from a floppy disk and use some third-party NTFS driver for this system.

Beginning with Windows versions NT 5.0 (new name for Windows 2000) Microsoft supports the new NTFS 5.0 file system. The new version of NTFS introduced additional file attributes; along with the access right, the concept of access prohibition was introduced, which allows, for example, when a user inherits group rights to a file, to prohibit him from changing its contents. New system also allows:

impose restrictions (quotas) on the amount of disk space provided to users;

map any directory (both local and remote) to a subdirectory on the local drive.

An interesting feature of the new version of Windows NT is the dynamic encryption of files and directories, which increases the reliability of information storage. Windows NT 5.0 includes an Encrypting File System (EFS) that uses shared-key encryption algorithms. If the encryption attribute is set for a file, then when the user program accesses the file for writing or reading, the file is encrypted and decoded transparently for the program.

.2 Comparison of NTFS and FAT32

Advantages:

Fast access to small files;

The size of disk space today is practically unlimited;

File fragmentation does not affect the file system itself;

High reliability of data storage and the actual file structure;

High performance when working with large files;

Flaws:

Higher volume requirements random access memory compared to FAT 32;

Working with directories of medium size is difficult due to their fragmentation;

More low speed performance compared to FAT 3232

Advantages:

High speed of work;

Low RAM requirement;

Efficient work with files of medium and small sizes;

Less disk wear due to less read/write head movement.

Flaws:

Low protection against system failures;

Not effective work with large files

Restriction on the maximum size of the section and file;

Reduced performance during fragmentation;

Reduced performance when working with directories containing a large number of files;

So, both file systems store data in clusters, the minimum size of which is 512 b. As a rule, the usual cluster size is 4 Kb. This is where the similarities probably end. Something about fragmentation: NTFS speed drops dramatically when the disk is 80 - 90% full. This is due to the fragmentation of service and working files. The more you work with such a loaded disk, the more fragmentation and the lower the performance. In FAT 32, fragmentation of the working area of ​​the disk also occurs at earlier stages. The point here depends on how often you write / erase data. As with NTFS, fragmentation greatly reduces performance. Now about RAM. The volume of the FAT 32 spreadsheet itself can take up several megabytes in RAM. But caching comes to the rescue. What is cached:

Most used directories;

Data on all currently used files;

Information about free disk space;

But what about NTFS? Caching is difficult for large directories, and they can reach several tens of megabytes in size. Plus MFT, plus information about free disk space. Although it should be noted that NTFS still consumes RAM resources quite economically. In the presence of a successful data storage system, in the MFT each entry is approximately equal to 1 Kb. But still, the requirements for RAM are higher than for FAT 32. In short, if your memory is less than or equal to 64 Mb, then FAT 32 will be more efficient in terms of speed. If more, the difference in speed will be small, and often not at all. Now about the hard drive itself. To use NTFS, Bus Mastering is desirable. What is this? This is a special mode of operation of the driver and controller. When using BM, the exchange occurs without the participation of the processor. The absence of a VM will affect system performance. In addition, due to the use of a more complex file system, the number of read / write head movements increases, which also affects the speed. The presence of a disk cache has an equally positive effect on both NTFS and FAT 32.

Conclusion

The advantages of FAT are low data storage overhead and total compatibility with a huge number of operating systems and hardware platforms. This file system is still used to format floppy disks, where the large volume of the partition supported by other file systems does not play a role, and low overhead allows you to economically use a small disk space (NTFS requires more space to store data, which is completely unacceptable for diskettes ).

The scope of FAT32 is actually much narrower - this file system should be used if you are going to access partitions and Windows 9x and using Windows 2000/XP. But since the relevance of Windows 9x today has practically disappeared, the use of this file system is not of particular interest.

Bibliography

1. http://yura. puslapiai. lt/archiv/per/fat.html

FAT file systems

FAT16

The FAT16 file system dates back to pre-MS-DOS times and is supported by all operating systems. Microsoft systems to ensure compatibility. Its name File Allocation Table (file location table) perfectly reflects the physical organization of the file system, the main characteristics of which include the fact that the maximum size of a supported volume (hard disk or partition on a hard disk) does not exceed 4095 MB. In the days of MS-DOS, 4 GB hard drives seemed like an impossible dream (20-40 MB drives were a luxury), so such a reserve was quite justified.

A volume formatted to use FAT16 is divided into clusters. The default cluster size depends on the size of the volume and can range from 512 bytes to 64 KB. In table. Figure 2 shows how the cluster size depends on the volume size. Note that the cluster size may differ from the default value, but must have one of the values ​​specified in Table 1. 2.

It is not recommended to use the FAT16 file system on volumes larger than 511 MB, since disk space will be used extremely inefficiently for relatively small files (a 1-byte file will take 64 KB). Regardless of the cluster size, the FAT16 file system is not supported for volumes larger than 4 GB.

FAT32

Starting with Microsoft Windows 95 OEM Service Release 2 (OSR2), Windows introduced support for 32-bit FAT. For Windows NT-based systems, this file system was first supported in Microsoft Windows 2000. While FAT16 can support volumes up to 4 GB, FAT32 can support volumes up to 2 TB. The cluster size in FAT32 can vary from 1 (512 bytes) to 64 sectors (32 KB). FAT32 cluster values ​​require 4 bytes to store (32 bits, not 16 as in FAT16). This means, in particular, that some file utilities designed for FAT16 cannot work with FAT32.

The main difference between FAT32 and FAT16 is that the size of the disk logical partition has changed. FAT32 supports volumes up to 127 GB. At the same time, if when using FAT16 with 2 GB disks, a 32 KB cluster was required, then in FAT32 a 4 KB cluster is suitable for disks from 512 MB to 8 GB (Table 4).

This accordingly means more efficient use of disk space - the smaller the cluster, the less space is required to store the file and, as a result, the disk becomes less fragmented.

When using FAT32, the maximum file size can be up to 4 GB minus 2 bytes. If when using FAT16 the maximum number of entries in the root directory was limited to 512, then FAT32 allows you to increase this number to 65,535.

FAT32 imposes restrictions on the minimum volume size - it must be at least 65,527 clusters. At the same time, the cluster size cannot be such that the FAT occupies more than 16 MB - 64 KB / 4 or 4 million clusters.

When using long filenames, the data required for access from FAT16 and FAT32 does not overlap. When a file is created with a long filename, Windows creates the corresponding 8.3 format name and one or more directory entries to store the long name (13 characters from the long filename per entry). Each subsequent occurrence stores the corresponding part of the filename in Unicode format. Such entries have the attributes "volume id", "read-only", "system", and "hidden", a set that is ignored by MS-DOS; on this operating system, a file is accessed by its "alias" in 8.3 format.

NTFS file system

IN Microsoft lineup Windows 2000 includes support for a new version of the NTFS file system, which, in particular, provides directory services Active Directory, reparse points, information security tools, access control and a number of other features.

As with FAT, the main information unit in NTFS is a cluster. In table. Figure 5 shows the default cluster sizes for volumes of various sizes.

When you create an NTFS file system, the formatter creates a Master File Table (MTF) file and other areas for storing metadata. Metadata is used by NTFS to implement the file structure. The first 16 entries in the MFT are reserved by NTFS itself. The location of the metadata files $Mft and $MftMirr is recorded in the boot sector of the disk. If the first entry in the MFT is corrupted, NTFS reads the second entry to find a copy of the first. A complete copy of the boot sector is located at the end of the volume. In table. 6 lists the main metadata stored in the MFT.

The remaining MFT entries contain entries for each file and directory located on the volume.

Typically, one file uses one entry in the MFT, but if the file has a large set of attributes or becomes too fragmented, additional entries may be required to store information about it. In this case, the first record about the file, called the base record, stores the location of the other records. Data about files and directories of small size (up to 1500 bytes) is completely contained in the first entry.

File attributes in NTFS

Each occupied sector on an NTFS volume belongs to a particular file. Even the file system metadata is part of the file. NTFS treats each file (or directory) as a set of file attributes. Elements such as the file name, its protection information, and even the data in it are attributes of the file. Each attribute is identified by a specific type code and, optionally, by an attribute name.

If the attributes of a file fit within a file record, they are called resident attributes. These attributes are always the name of the file and the date it was created. In cases where the information about a file is too large to fit into a single MFT record, some of the file's attributes become non-resident. Resident attributes are stored in one or more clusters and represent a stream of alternate data for the current volume (more on that below). To describe the location of resident and non-resident attributes, NTFS creates an Attribute List attribute.

In table. 7 shows the main file attributes defined in NTFS. This list may be expanded in the future.

CDFS file system

Windows 2000 provides support for the CDFS file system, which conforms to the ISO'9660 standard, which describes the location of information on a CD-ROM. Supported long names files in accordance with ISO'9660 Level 2.

When creating a CD-ROM for use under Windows control 2000, keep the following in mind:

• all directory and file names must be less than 32 characters;
• all directory and file names must contain only uppercase characters;
• the depth of directories should not exceed 8 levels from the root;
• the use of filename extensions is optional.

Comparison of file systems

Under Microsoft Windows 2000, FAT16, FAT32, NTFS, or combinations of these file systems can be used. The choice of operating system depends on the following criteria:

• how the computer is used;
• hardware platform;
• size and number of hard drives;
• information security

FAT file systems

As you may have noticed, the numbers in the names of the file systems - FAT16 and FAT32 - indicate the number of bits required to store information about the cluster numbers used by the file. So, FAT16 uses 16-bit addressing and, accordingly, it is possible to use up to 216 addresses. In Windows 2000, the first four bits of the FAT32 file location table are needed for internal use, so FAT32 reaches 228 addresses.

In table. 8 shows cluster sizes for FAT16 and FAT32 file systems.

In addition to significant differences in cluster size, FAT32 also allows the root directory to expand (in FAT16, the number of entries is limited to 512 and can be even lower when using long filenames).

Benefits of FAT16

Among the advantages of FAT16 are the following:

• the file system is supported by MS-DOS, Windows 95, Windows 98, Windows NT, Windows 2000, and some UNIX operating systems;
• there are a large number of programs that allow you to correct errors in this file system and recover data;
• if there are problems with booting from the hard disk, the system can be booted from the floppy disk;
• this file system is quite efficient for volumes smaller than 256 MB.

Disadvantages of FAT16

The main disadvantages of FAT16 include:

• the root directory cannot contain more than 512 entries. Using long filenames greatly reduces the number of these elements;
• FAT16 supports a maximum of 65,536 clusters, and since some clusters are reserved by the operating system, the number of available clusters is 65,524. Each cluster has a fixed size for a given LUN. When the maximum number of clusters is reached at their maximum size (32 KB), the maximum supported volume is limited to 4 GB (under Windows 2000). To maintain compatibility with MS-DOS, Windows 95, and Windows 98, the size of a FAT16 volume must not exceed 2 GB;
• FAT16 does not support built-in file protection and compression;
• on large disks, a lot of space is wasted due to the fact that the maximum cluster size is used. The space for the file is allocated based on the size of the cluster, not the file.

Benefits of FAT32

Among the advantages of FAT32 are the following:

• disk space allocation is performed more efficiently, especially for large disks;
• the root directory in FAT32 is a regular chain of clusters and can be located anywhere on the disk. Because of this, FAT32 does not impose any restrictions on the number of items in the root directory;
• due to the use of smaller clusters (4 KB on disks up to 8 GB), the occupied disk space is usually 10-15% less than under FAT16;
• FAT32 is the more secure file system. In particular, it supports the ability to move the root directory and use backup FAT. In addition, the boot record contains a number of critical data for the file system.

Disadvantages of FAT32

The main disadvantages of FAT32:

• the volume size when using FAT32 under Windows 2000 is limited to 32 GB;
• FAT32 volumes are not available from other operating systems - only from Windows 95 OSR2 and Windows 98;
• boot sector backup is not supported;
• FAT32 does not support built-in file protection and compression.

NTFS file system

When using Windows 2000, Microsoft recommends that you format all hard disk partitions to NTFS, except for configurations where multiple operating systems are used (except Windows 2000 and Windows NT). Using NTFS instead of FAT allows you to use the features available in NTFS. These include, in particular:

• the possibility of recovery. This feature is "built into" the file system. NTFS guarantees the safety of data due to the fact that it uses a protocol and some information recovery algorithms. In the event of a system failure, NTFS uses the protocol and Additional information For automatic recovery file system integrity;
• information compression. For NTFS volumes, Windows 2000 supports single file compression. Such compressed files can be used by Windows applications without prior decompression, which occurs automatically when reading from the file. When closing and saving the file is packed again;
• In addition, the following advantages of NTFS can be distinguished:

Some operating system features require NTFS;

Access speed is much faster - NTFS minimizes the number of disk accesses required to find a file;

Protection of files and directories. Only on NTFS volumes it is possible to set file and folder access attributes;

When using NTFS, Windows 2000 supports volumes up to 2TB;

The file system maintains a backup copy of the boot sector - it is located at the end of the volume;

NTFS supports the Encrypted File System (EFS) encryption system, which provides protection against unauthorized access to the contents of files;

When using quotas, you can limit the amount of disk space used by users.

Disadvantages of NTFS

Speaking about the shortcomings of the NTFS file system, it should be noted that:

• NTFS volumes are not available on MS-DOS, Windows 95, and Windows 98. In addition, a number of features that are available in NTFS under Windows 2000 are not available on Windows 4.0 and earlier;
• Small volumes containing many small files may experience performance degradation compared to FAT.

File system and speed

As we have already found out, for small volumes, FAT16 or FAT32 provides faster file access compared to NTFS, because:

• FAT has a simpler structure;
• directories are smaller;
• FAT does not support protecting files from unauthorized access - the system does not need to check file permissions.

NTFS minimizes the number of disk accesses and the time it takes to find a file. Also, if the directory size is small enough to fit in a single MFT entry, the entire entry is read in one go.

One entry in the FAT contains the cluster number for the first cluster in the directory. Viewing a FAT file requires searching through the entire file structure.

When comparing the speed of operations performed for directories containing short and long file names, it should be taken into account that the speed of operations for FAT depends on the operation itself and the size of the directory. If FAT looks for a file that doesn't exist, it searches the entire directory, an operation that takes longer than searching the B-tree structure used by NTFS. The average time it takes to find a file in FAT is expressed as a function of N/2, in NTFS it is expressed as log N, where N is the number of files.

A number of the following factors affect the speed of reading and writing files under Windows 2000:

• file fragmentation. If the file is highly fragmented, NTFS usually requires fewer disk accesses than FAT to find all the fragments;
• cluster size. For both file systems, the default cluster size depends on the size of the volume and is always expressed as a power of 2. Addresses in FAT16 are 16-bit, in FAT32 they are 32-bit, in NTFS they are 64-bit;
• the default cluster size in FAT is based on the fact that the file location table can have no more than 65,535 entries - the cluster size is a function of the volume size divided by 65,535. Thus, the default cluster size for a FAT volume is always larger than than the cluster size for an NTFS volume of the same size. Note that a larger cluster size for FAT volumes means that FAT volumes can be less fragmented;
• location of small files. When using NTFS, small files are contained in an MFT record. The size of a file that fits into a single MFT record depends on the number of attributes in that file.

Maximum size of NTFS volumes

Theoretically, NTFS supports volumes with up to 232 clusters. But nevertheless, in addition to the lack of hard drives of this size, there are other restrictions on the maximum size of the volume.

One such limitation is the partition table. Industry standards limit the size of the partition table 2 to 32 sectors. Another limitation is the sector size, which is typically 512 bytes. Since the sector size may change in the future, the current size limits the size of a single volume to 2 TB (2 32 x 512 bytes = 2 41). Thus, 2TB is the practical limit for NTFS physical and logical volumes.

In table. Figure 11 shows the main limitations of NTFS.

Managing access to files and directories

When using NTFS volumes, you can set file and directory permissions. These access rights specify which users and groups have access to them and what level of access is allowed. Such access rights apply both to users working on the computer on which the files are located, and to users accessing files over the network when the file is located in a directory open for remote access.

Under NTFS, you can also set remote access permissions combined with file and directory permissions. In addition, file attributes (read-only, hidden, system) also restrict access to the file.

Under FAT16 and FAT32, it is also possible to set file attributes, but they do not provide file permissions.

The version of NTFS used in Windows 2000 introduced a new type of access permission called inherited permissions. The Security tab contains the option Allow inheritable permissions from parent to propagate to this file object, which is active by default. This option significantly reduces the time required to change the permissions for files and subdirectories. For example, to change the permissions of a tree containing hundreds of subdirectories and files, it is enough to enable this option - in Windows NT 4, you must change the attributes of each individual file and subdirectory.

On fig. Figure 5 shows the Properties dialog box and the Security tab (Advanced section) listing extended file permissions.

Recall that for FAT volumes, access can only be controlled at the volume level, and such control is possible only with remote access.

Compressing files and directories

Windows 2000 supports compression of files and directories located on NTFS volumes. Compressed files are readable and writable by any Windows application. For this, there is no need for their preliminary unpacking. The compression algorithm used is similar to that used in DoubleSpace (MS-DOS 6.0) and DriveSpace (MS-DOS 6.22), but has one significant difference - under MS-DOS, an entire primary partition or logical device is compressed, while under NTFS you can pack individual files and directories.

The compression algorithm in NTFS is designed to support clusters up to 4 KB in size. If the cluster size is larger than 4 KB, the NTFS compression features become unavailable.

Self-healing NTFS

The NTFS file system is self-healing and can maintain its integrity through the use of a log of actions taken and a number of other mechanisms.

NTFS treats every operation that modifies system files on NTFS volumes as a transaction and stores information about such a transaction in a log. A started transaction can either be completely completed (commit) or rolled back (rollback). In the latter case, the NTFS volume returns to the state prior to the start of the transaction. In order to manage transactions, NTFS writes all the operations involved in a transaction to a log file before it is written to disk. After the transaction is completed, all operations are performed. Thus, under NTFS management, there can be no pending operations. In the event of disk failures, pending operations are simply cancelled.

Under the control of NTFS, operations are also performed that allow you to identify bad clusters on the fly and allocate new clusters for file operations. This mechanism is called cluster remapping.

In this review, we examined the various file systems supported in Microsoft Windows 2000, discussed the design of each of them, noted their advantages and disadvantages. The most promising is the NTFS file system, which has big set features not available on other file systems. The new version of NTFS supported by Microsoft Windows 2000 has even more functionality and is therefore recommended for use when installing the Win 2000 operating system.

ComputerPress 7"2000

Every time I use either FatFs, I think it would be nice to figure out how everything works inside. I put off this question for a long time, finally the ice broke. So, the global goal is to light up memory cards, if it works out in detail, the current goal is to deal with the file system.

I must say right away that I did not have a goal to write my own driver or understand the intricacies in detail, I was just interested. The task is quite simple to understand, so there will be no "codes" here.

So, the first thing we need to understand is that when communicating with a memory card directly, we can either read or write 512 bytes, no other actions are given. Since we are constantly copying or deleting files, and the file sizes are always different, empty areas will appear on the map mixed with the recorded ones. So that the user does not bother with the placement of data, there is a layer that takes care of these worries, this is the file system.

As mentioned above, it is possible to write and read only a multiple of 512 bytes, i.e. 1 sector. There is also a concept - a cluster is stupidly several sectors, for example, if the cluster size is 16kB, then it means that it has 16000/512 = 31.25, more precisely 32 sectors, and the actual size of the cluster is 16384 bytes. All files occupy a size multiple of the cluster size. Even if the file is 1kB and the cluster is 16kB, the file will take all 16kB.

It would be logical to make clusters of small size, then the restriction on the maximum number of files and their size comes into play. FAT16 operates on 16 bit data, so you can't cram more than 2^16 clusters. Therefore, the smaller their size, the more efficiently the space for small files is used, but the less information can be crammed onto the disk. And vice versa, the larger the size, the more information you can cram, but the less efficiently the space for small files is used. Maximum size 64kB cluster, so the maximum for FAT16 is 64kb*2^16 = 4GB.

Initial data: there is a 1GB micro SD memory card. Labeled MYDISK, fully formatted, cluster size 16kB.

You will need a Hex editor, but any will not do, you need one that can view the entire disk, and not just the files on the disk. From what I managed to find: WinHex is the most suitable, but paid; HxD is simple, free, but I've never been able to get it to save changes to disk; DMDE is a little user friendly, free and allows you to save changes. In general, I settled on HxD.

To begin with, it is worth considering the FAT16 structure, the picture shows the order in which the various parts of the file system are located.

The boot sector stores all service information. Inside the FAT region, information is stored about how the file data is located on the disk. The root directory contains information about what files are in the root of the disk. The data area contains the information contained within the files. All areas strictly follow each other in a row, i.e. after the boot sector, the FAT area immediately begins. Let's look at the details below.

Task: to understand by what principle the names of files and their contents are arranged. Therefore, let's start by looking for the root directory to understand what files we have available. The data from the boot area will help us with this.

The most interesting data are shown in the table

The first thing we need to know is the size of the boot area. We look at the address 0x0E and see that 4 sectors are allocated for the boot area, i.e. FAT area starts from address 4*512 = 0x800.

The number of FAT tables can be determined at address 0x10 of the boot area. In our example, there are two of them, why two, because each table is duplicated by a backup one, so that in case of a failure it would be possible to restore the data. The table size is specified at address 0x16. Thus, the size of the fat is 512*2*0xEE = 0x3B800, and the root directory starts from the address: 0x800 + 0x3B800 = 0x3C000

Inside the root directory, all elements are split into 32 bytes. The first element is the volume label, while the subsequent elements are files and folders. If the filename starts with 0xE5, it means that the file has been deleted. If the name starts with 0x00, it means that the previous file was the last one.

Quite an interesting structure of the root directory turned out for me. The card was formatted completely, then 2 text files were created, which were renamed MyFile.txt and BigFile.txt.

As you can see, in addition to my two files, a bunch of left ones were created, the origin of which can only be guessed at.

The most important thing that can be drawn here is the address of the first cluster, from which the data of our file begins. The address is always located at offset 0x1A. For example, the name of our file MyFile.txt is located at 0x3C100, we add 0x1A to it, we see the number of the first cluster there. = 0x0002 i.e. second cluster. For the BigFile.txt file, the data starts from the third cluster.

Also in the root directory, you can also find out the date and time of the last editing of the file, this question was not very interesting to me, so I will bypass it. The last useful thing the root directory has to say is its size, so we can find where the data starts from.

The size is specified in the boot sector at 0x11(2 bytes) = 0x0200*32 = 0x4000 or 16384 bytes.

Let's add its size to the root address: 3С000 + 4000 = 40000 is the address of the first data cluster, but we need the second one to find MyFile.txt. The number of sectors in the cluster is 32, cluster size = 32*512 = 16384 or 0x4000, so let's add to the address of the first cluster, its size i.e. with 0x44000, the second cluster is supposed to start.

We go to the address 0x44000 and see that the data belongs to BigFile.txt (it's just garbage)

It turns out there is a slight subtlety, the numbering of clusters starts from the second, it is not clear why this is done, but the fact is, i.e. in fact, we have moved to the third cluster. Let's go back one cluster to address 0x40000 and see the expected data.

Now it is asked. Why do we need a FAT table? The fact is that data can be fragmented, i.e. the beginning of a file can be in one cluster, and the end in a completely different one. And it can be completely different clusters. There may be several of them, scattered in different data areas. The FAT table is a kind of map that tells us how to move between clusters.

Let's give an example, in the BigFile.txt file, a bunch of random garbage is stuffed so that it occupies not one cluster, but several. We go to where the FAT table begins and look at its contents.

The first eight bytes 0xF8FFFFFF is the ID of the start of the FAT table. Next comes 2 bytes that refer to MyFile.txt, the fact that 0xFFFF is written in them means that the file occupies only one cluster. But the next BigFile.txt file starts in the third cluster, we remember this from the root directory, continues in the fourth, then goes to 5,6,7 ... and ends in 12, i.e. occupies 10 clusters.

Let's check if this is true. The file weighs 163kB, i.e. occupies 163000/(32*512) = 9.9 clusters, which is quite like expected. We repeat once again that one element in the FAT table occupies 2 bytes, i.e. 16 bits, hence the name FAT16. Accordingly, the maximum address is 0xFFFF, i.e. maximum size for FAT16 0xFFFF*cluster size.

Let's move on to FAT32. The boot part has changed a bit.

There are some fundamental changes. The file system name has moved to address 0x52, the size of the root is now ignored. The data area is just behind the FAT tables, the root directory is inside the data area. Additionally, the root directory does not have a fixed size.

The address of the data area is calculated:
boot sector size + FAT table, in my case it turned out:
746496 + (3821056 * 2) = 0x800000

The address of the root directory is calculated:
(the number of the first cluster of the root directory is 2) * cluster size + address of the beginning of the data area,
those. in this example, it will match the beginning of the data area.

As before, the data in the root takes up 32 bytes, as before the "deleted" magic files, I assume these are temporary notepad files.

But the beginning of the first cluster in MYFILE.txt is now determined by two bytes, the older one is at offset 0x14, the younger one is 1A as before. Therefore, the number of the first data cluster for the file will be:
8000A0 + 0x14 = 0x8000B4 - high byte
8000A0 + 0x1A = 0x8000BA - low byte
In my case, the map was only with one file, so this is the third cluster.

The FAT table is searched as in the previous case, only now the elements occupy 4 bytes, hence the name FAT32. The ideology of the arrangement of elements is exactly the same as in the previous case.

Useful things for the table
F8 FF FF F0 - first cluster
FF FF FF 0F - last cluster
FF FF FF F7 - bad cluster

Where is the data?
start of data area + cluster size * (root cluster number - 1)
= 0x800000 + (2*4096) = 0x801000

I hope in general terms it became clear, it seems like there is nothing supernatural. Who read and repeated can eat a cookie 🙂

FAT(English) file Allocation table- "file allocation table") - the classic file system architecture, which, due to its simplicity, is still widely used for flash drives. Used in floppy disks and some other storage media. Previously used on hard drives.

The file system was developed by Bill Gates and Mark McDonald in 1977 and was originally used in the 86-DOS operating system. 86-DOS was later acquired by Microsoft and became the basis for MS-DOS 1.0, released in August 1981. FAT was designed to work with floppy disks smaller than 1 MB, and did not initially support hard disks.

There are currently four versions of FAT - FAT8, FAT12, FAT16 And FAT32. They differ in the bitness of records in the disk structure, that is the number of bits allocated to store the cluster number. FAT12 is mainly used for floppy disks, FAT16 for small disks, FAT32 for hard disks. Based on FAT, a new file system was developed exFAT(extended FAT), used primarily for flash drives.

The FAT file system fills free disk space sequentially from beginning to end. When creating a new file or expanding an existing one, it looks for the first free cluster in the file allocation table. If some files have been deleted and others have changed in size, the resulting empty clusters will be scattered across the disk. If the clusters containing the file data are not in a row, then the file is fragmented. Heavily fragmented files significantly reduce work efficiency, since the read / write heads, when searching for the next file record, will have to move from one area of ​​\u200b\u200bthe disk to another. It is desirable that the clusters allocated for storing the file are kept short, as this allows to reduce the time it takes to search for it. However, this can only be done using a special program, a similar procedure is called defragmentation file.

The disadvantage of FAT is also that its performance depends on the number of files in one directory. With a large number of files (about a thousand), the operation of reading the list of files in the directory may take several minutes. FAT does not store information such as owner information or file permissions.

FAT is a simple file system that does not prevent file corruption due to abnormal shutdown of the computer, it is one of the most common file systems and most operating systems support it.

Organization of the fat file system

All modern disk operating systems provide the creation of a file system designed to store data on disks and provide access to them. In order for data to be written to a disk, its surface must be structured - i.e. divide into sectors And tracks.

A- track

C-cluster

Figure 1 - Disk structure

Tracks are concentric circles covering the surface of the disk. The track closest to the edge of the disk is assigned the number 0, the one following it is assigned the number 1, and so on. If the diskette is double-sided, then both sides are numbered. The number of the first side is 0, the number of the second is 1.

Each track is divided into sections called sectors. Sectors are also assigned numbers. The first sector on the track is assigned the number 1, the second - 2, and so on.

A hard drive is made up of one or more round platters. Both surfaces of the plate are used to store information. Each surface is divided into tracks, the tracks, in turn, into sectors. Tracks of the same radius are cylinder. Thus, all zero tracks make up cylinder number zero, tracks number 1 make cylinder number 1, and so on.

Therefore, the surface of a hard disk can be considered as a three-dimensional matrix, the dimensions of which are the numbers surface, cylinder And sectors. A cylinder is understood as a set of all tracks belonging to different surfaces and located at an equal distance from the axis of rotation.

In FAT, filenames are in 8.3 format and consist only of ASCII characters. Support for long (up to 255 characters) filenames has been added to VFAT. Long File Name, LFN) encoded in UTF-16LE, with LFNs stored at the same time as 8.3 names, retrospectively referred to as SFNs. Short File Name). LFNs are case-insensitive when looking up, however, unlike SFNs, which are stored in upper case, LFNs retain the case specified when the file was created.

Structure of the FAT system

In the FAT file system, contiguous disk sectors are combined into units called clusters. The number of sectors in a cluster is equal to a power of two (see below). An integer number of clusters (at least one) is allocated for storing file data, so, for example, if the file size is 40 bytes and the cluster size is 4 kbytes, only 1% of the space allocated for it will actually be occupied by the file information. To avoid such situations, it is advisable to reduce the size of clusters, and vice versa to reduce the amount of address information and increase the speed of file operations. In practice some compromise is chosen. Since the capacity of a disk may well not be expressed in an integer number of clusters, there are usually so-called "units" at the end of the volume. surplus sectors - a "residue" less than a cluster in size, which cannot be allocated by the OS for storing information.

The FAT32 volume space is logically divided into three contiguous areas:

• reserved area. Contains service structures that belong to a partition boot record (Partition Boot Record - PBR, to distinguish it from Master Boot Record - the master boot record of a disk; also PBR is often incorrectly called a boot sector) and are used when initializing a volume;
• An area of ​​a FAT table containing an array of index pointers ("cells") corresponding to data area clusters. Usually there are two copies of the FAT table on the disk for reliability purposes;
• The data area where the actual contents of the files are recorded - that is, the text of text files, the encoded image for picture files, the digitized sound for audio files, etc. - as well as the so-called. metadata - information about file and folder names, their attributes, creation and modification times, size and location on disk.

FAT12 and FAT16 also have a dedicated area for the root directory. It has a fixed position (immediately after the last entry in the FAT table) and a fixed size in sectors.

If a cluster belongs to a file, then the cell corresponding to it contains the number of the next cluster of the same file. If the cell corresponds to the last cluster of the file, then it contains a special value (FFFF 16 for FAT16). Thus, a chain of file clusters is built. Zeros correspond to unused clusters in the table. "Bad" clusters (which are excluded from processing, for example, because the corresponding area of ​​the device is unreadable) also have a special code.

When a file is deleted, the first character of the name is replaced with a special code E5 16 and the chain of file clusters in the allocation table is reset to zero. Since the information about the file size (which is located in the directory next to the file name) remains intact, if the file clusters were located sequentially on the disk and they were not overwritten with new information, it is possible to recover the deleted file.

boot record

The first structure of a FAT volume is called BPB. BIOS parameter block ) and is located in the reserved area, in sector zero. This structure contains information identifying the type of file system and the physical characteristics of the medium (floppy disk or hard disk partition).

BIOS Parameter Block

BPB was basically absent from the FAT that served MS-DOS 1.x, since at that time only two various types volumes - one- and two-sided five-inch 360 kb floppy disks, and the volume format was determined by the first byte of the FAT area. BPB was introduced in MS-DOS 2.x in early 1983 as a mandatory boot sector structure from which to determine the volume format henceforth; the old FAT first byte detection scheme is no longer supported. Also in MS-DOS 2.0, a hierarchy of files and folders was introduced (before that, all files were stored in the root directory).

The BPB structure in MS-DOS 2.x contained a 16-bit "total number of sectors" field, which meant that this version of FAT was fundamentally inapplicable for volumes larger than 2 16 = 65,536 sectors, that is, more than 32 MB with a standard sector size of 512 bytes. In MS-DOS 4.0 (1988), the above BPB field was extended to 32 bits, which meant an increase in the theoretical volume size to 232 = 4,294,967,296 sectors, i.e. up to 2 TB with a 512-byte sector.

The next modification of BPB appeared with Windows 95 OSR2, which introduced FAT32 (in August 1996). The two-gigabyte limit on volume size has been removed, a FAT32 volume can theoretically be up to 8 TB in size. However, the size of each individual file cannot exceed 4 GB. The BIOS Parameter Block FAT32 repeats BPB FAT16 up to and including the BPB_TotSec32 field for compatibility with earlier versions of FAT, followed by differences.

The FAT32 "boot sector" is actually three 512-byte sectors - sectors 0, 1 and 2. Each of them contains the signature 0xAA55 at address 0x1FE, that is, in the last two bytes, if the sector size is 512 bytes. If the sector size is more than 512 bytes, then the signature is contained both at address 0x1FE and in the last two bytes of the zero sector, that is, it is duplicated.

FSInfo

The boot record of a FAT32 partition contains a structure called FSInfo, used to store the value of the number of free clusters on the volume. FSInfo, as a rule, occupies sector 1 (see the BPB_FSInfo field) and has the following structure (addresses relative to the beginning of the sector):

• FSI_LeadSig. The 4-byte signature 0x41615252 indicates that the sector is being used for the FSInfo structure.
• FSI_Reserved1. The interval from the 4th to the 483rd bytes of the sector, inclusive, is reset to zero.
• FSI_StrucSig. Another signature is located at 0x1E4 and contains the value 0x61417272.
• FSI_Free_Count. The four-byte field at address 0x1E8 contains the last number of free clusters on the volume known to the system. The value 0xFFFFFFFF means that the number of free clusters is unknown and must be calculated.
• FSI_Nxt_Free. A four-byte field at address 0x1EC contains the cluster number from which the search for free clusters in the index pointer table should begin. Typically, this field contains the number of the last FAT cluster assigned to store the file. The value 0xFFFFFFFF means that the search for a free cluster should be carried out from the very beginning of the FAT table, that is, from the second cluster.
• FSI_Reserved2. Reserved 12-byte field at address 0x1F0.
• FSI_TrailSig. Signature 0xAA550000 - the last 4 bytes of the FSInfo sector.

The point of introducing FSInfo is to optimize the system performance, since in FAT32 the index pointer table can be large and its byte-by-byte lookup can take a significant amount of time. However, the values ​​of the fields FSI_Free_Count and FSI_Nxt_Free may not correspond to reality and should be checked for adequacy. In addition, they are not even updated in the FSInfo backup, which is usually located in sector 7.

Determining the type of FAT volume

Determining the type of FAT volume (that is, the choice between FAT12, FAT16 and FAT32) is made by the OS based on the number of clusters in the volume, which in turn is determined from the BPB fields. First of all, the number of sectors of the root directory is calculated:

RootDirSectors = (BPB_RootEntCnt * 32) / BPB_BytsPerSec

DataSec = TotSec - (BPB_ResvdSecCnt + (BPB_NumFATs * FATSz) + RootDirSectors)

Finally, the number of data area clusters is determined:

CountofClusters = DataSec / BPB_SecPerClus

By the number of clusters, there is a one-to-one correspondence with the file system:

• CountofClusters< 4085 - FAT12
• CountofClusters = 4085 ÷ 65524 - FAT16
• CountofClusters > 65524 - FAT32

According to the official specification, this is the only valid way to determine the FAT type. Artificially creating a volume that violates the specified mapping rules will cause it to be handled incorrectly by Windows. However, it is recommended to avoid values ​​of CountofClusters that are close to the critical values ​​(4085 and 65525) in order to correctly determine the type of the file system by any, often incorrectly written, drivers.

Over time, FAT began to be widely used in various devices for compatibility between DOS, Windows, OS/2, Linux. Microsoft has shown no intention of forcing them to be licensed [ specify] .

In February 2009, Microsoft sued TomTom, a maker of Linux-based in-car navigation systems, for patent infringement.

Notes

1. http://cd.textfiles.com/megademo2/INFO/OS2_HPFS.TXT
2. www.microsoft.com/mscorp/ip/tech/fathist.asp at archive.org
3. Microsoft Extensible Firmware Initiative FAT32 File System Specification 1.03. Microsoft (December 6, 2000). - Document format Microsoft Word, 268 Kb. archived
4. What About VFAT? . TechNet Archive. Microsoft (October 15, 1999). Archived from the original on August 22, 2011. Retrieved April 5, 2010.
5. Do not confuse the VFAT file system extension with the file system driver of the same name, which appeared in Windows for Workgroups 3.11 and is designed to handle MS-DOS function calls (INT 21h) in protected mode (see: KB126746: Windows for Workgroups Version History . VERSION 3.11 → Non-Network Features. Microsoft (November 14, 2003). Archived from the original on August 22, 2011. Retrieved April 5, 2010.)
6. Federal Patent Court declares FAT patent of Microsoft null and void . heise online. Heise Zeitschriften Verlag (March 2, 2007). archived
7. Brian Kahin. Microsoft Roils the World with FAT Patents. The Huffington Post (March 10, 2009). Archived from the original on August 22, 2011. Retrieved March 10, 2009.
8. Ryan Paul. Microsoft suit over FAT patents could open OSS Pandora's Box (English) . Ars Technica. Condé Nast Publications (February 25, 2009). archived
9. Glyn Moody.(English) . Computerworld UK. IDG (March 5, 2009). Archived from the original on August 22, 2011. Retrieved March 9, 2009.
10. Steven J. Vaughan-Nichols. Linux companies sign Microsoft patent protection pacts. Blogs. IDG (March 5, 2009). Archived from the original on August 22, 2011. Retrieved March 9, 2009.
11. Erica Ogg. TomTom countersues Microsoft in patent dispute. CNet (March 19, 2009). Archived from the original on August 22, 2011. Retrieved March 20, 2009.

Links

• ECMA-107 FAT standard

Microsoft Windows Components
Main
Services management
Applications	Contact DVD Maker Fax and Scan Internet Explorer Magazine Magnifier media center Windows Media Player Program joint work Device Center Windows Mobile Mobility Center Narrator Paint Personal character editor Remote Assistance Speech recognition