FAT file system architecture. Features of FAT32, NTFS and exFAT file systems

1. FSInfo sector structure struct fat_boot_fsinfo:
   • __u32 signature1– signature 0x41615252;
   • __u32 signature2– signature 0x61417272;
   • __u32 free_clusters is the number of free clusters. If the field contains -1, the search for free clusters should start from cluster number 2.
2. Short name directory entry structure struct msdos_dir_entry:
   • __s8 name,ext– file name and extension;
   • __u8 attr– file attributes;
   • __u8 ctime_ms– this field specifies the file creation time up to ms (only FAT32 is used);
   • __u16 ctime– file creation time (only FAT32 is used);
   • __u16 cdate– file creation date (only FAT32 is used);
   • __u16 date– date of the last access to the file (only FAT32 is used);
   • __u16 starthi– upper 16 bits of the number of the first cluster of the file (only FAT32 is used);
   • __u16time,date,start– time and date of file creation, number of the first file cluster;
   • __u32 size– file size (in bytes).
3. Long name directory entry structure:
   • __u8 id– element number;
   • __u8 name0_4- characters 1 - 5 of the name;
   • __u8 attr– file attributes;
   • __u8 alias_checksum– checksum of the short name;
   • __u8 name5_10- characters 6 - 11 of the name;
   • __u8 name11_12- characters 12 - 13 of the name.

Let's continue the consideration of the software implementation of the algorithm and determine the name of the partition on which the FAT16 file system was created:

#ifndef FAT16_PART_NAME

#define FAT16_PART_NAME "/dev/hda1"

#endif

Global Structures:

struct fat_boot_sector fbs; // boot sector structure

struct msdos_dir_entry dentry; // directory element structure

Global variables:

U16 *fat16; // copy FAT16 table here

U16 sector_size; // sector size (from FAT16)

U16 dir_entries; // number of 32-byte descriptors

// in the root directory (0 for FAT32)

U16 sectors; // total number of sectors in the partition

U32 fat16_size; // FAT16 size

U32 root_size; // size of the root directory

U16 byte_per_cluster; // cluster size in bytes

U16 next_cluster; // next cluster in the chain

int fat;

Let's start with the main function:

int main()

int num;

We set the full name of the file whose contents we want to read. Let me remind you that we work only with short file names. The procedure for working with long names is not covered in this article.

U8 *full_path = "/Folder1/Folder2/text.txt";

Open the device file:

Hard = open(FAT16_PART_NAME, O_RDONLY);

If(hard< 0) {

error(FAT16_PART_NAME);

Exit(-1);

We read the first 10 clusters of the file. The reading is performed by the fat16_read_file() function. The function parameters are the full file name and the number of clusters to read. The function returns the number of clusters read or -1 if an error occurred while reading:

Num = fat16_read_file(full_path, 10);

If(num< 0) perror("fat16_read_file");

Else printf("Read %d clusters ", num);

Close the device file and exit:

close(hard);

return 0;

The function for reading file clusters is as follows:

int fat16_read_file(__u8 *full_path, int num)

Struct split_name sn; // structure for storing the component parts of the file

U8 tmp_name_buff; // buffer for temporary storage of composite elements of the full path of the file

Static int i = 1;

int n;

U8 *tmp_buff;

U16 start_cluster, next_cluster;

We listed the function parameters when considering the main function.

Preparatory operations - reset the tmp_name_buff buffer and the struct split_name sn structure:

The first character in an absolute pathname of a file must be a forward slash (/). Let's check it out:

Read the boot sector from the partition:

If(read_fbs()< 0) return -1;

The read boot sector is now in the global structure struct fat_boot_sector fbs. Copy from this structure the sector size, the number of entries in the root directory and the total number of sectors on the partition:

Determine the size of the cluster in bytes:

Byte_per_cluster = fbs.cluster_size * 512

Let's display the information in the boot sector:

Printf("System id - %s ", fbs.system_id);

Printf("Sector size - %d ", sector_size);

Printf("Cluster size - %d ", fbs.cluster_size);

Printf("Reserved - %d ", fbs.reserved);

Printf("FATs number - %d ",fbs.fats);

Printf("Dir entries - %d ", dir_entries);

Printf("Sectors - %d ", sectors);

Printf("Media - 0x%X ", fbs.media);

Printf("FAT16 length - %u ", fbs.fat_length);

Printf("Total sect - %u ", fbs.total_sect);

Printf("Byte per cluster - %d ", byte_per_cluster);

We calculate the size of FAT16 in bytes and read it:

fat16_size = fbs.fat_length * 512;

If(read_fat16()< 0) return -1;

Reading the root directory:

If(read_root_dentry()< 0) return -1;

The dir_entry pointer is now positioned to the memory area containing the root directory entries. The size of this memory area is equal to the size of the root directory (root_size).

Save (for control) the contents of the root directory in a separate file:

#ifdef DEBUG

close(fat);

#endif

Calculate the beginning of the data area:

data_start = 512 * fbs.reserved + fat16_size * fbs.fats + root_size;

With all the entries in the root directory, we can get to the contents of the test.txt file. To this end, we organize a cycle. In the body of the cycle, we will parse the full name of the file, highlighting its elements - subdirectories (we have two of them, Folder1 and Folder2) and the name of the desired file (test.txt).

While(1) (

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

For(n = 0 ; n< SHORT_NAME; n++, i++) {

If((tmp_name_buff[n] == "/") || (tmp_name_buff[n] == "?")) (

I++;

break;

tmp_name_buff[n] = "?";

We fill the structure struct split_name sn with the appropriate information. Filling is performed by the split_name function, and the file name is checked for compliance with the "8.3" format:

< 0) {

printf("not valid name");

return -1;

For each element of the full file name, we determine the initial cluster. To do this, we search in the directory elements (starting from the root) for an entry corresponding to the full name element, and read this entry. The search procedure is performed by the get_dentry() function:

If(get_dentry(&sn)< 0) {

Printf("No such file!");

return -1;

Checking file attributes. If it's a directory, read its contents and continue the loop:

If(dentry.attr & 0x10) (

If(read_directory(dentry.start)< 0) return -1;

continue;

If this is a file, we read the first num clusters. For control, the read information will be saved in a separate file:

If(dentry.attr & 0x20) (

Start_cluster = dentry.start;

tmp_buff = (__u8 *)malloc(byte_per_cluster); // the contents of the cluster will be read here

N = open("clust", O_CREAT|O_RDWR, 0600); // save the read information in this file

If(n< 0) {

error("open");

return -1;

To read the clusters of the file, we organize a loop:

For(i = 0; i< num; i++) {

We read the contents of the cluster into the tmp_buff buffer and save it in a separate file:

< 0) return -1;

< 0) {

error("write");

close(n);

return -1;

We read from FAT16 the number of the next cluster occupied by this file. If this is the last cluster, we break the loop and return to the main function:

#ifdef DEBUG

Printf("OK. Read");

Printf("file`s next cluster - 0x%X .. ", next_cluster);

#endif

If(next_cluster == EOF_FAT16) (

#ifdef DEBUG

Printf("last cluster. ");

#endif

Free(tmp_buff);

close(n);

Return ++i;

#ifdef DEBUG

printf("stop reading");

#endif

Return i;

The FAT16 boot sector is read by the read_fbs() function. The result is placed in the global fbs structure:

int read_fbs()

If(read(hard,(__u8 *)&fbs, sizeof(fbs))< 0) return -1;

return 0;

Reading the file allocation table of the FAT16 file system is performed by the read_fat16() function:

int read_fat16()

U64 seek = (__u64)(fbs.reserved) * 512; // offset to FAT16 from the beginning of the partition

Fat16 = (void *)malloc(fat16_size);

If(pred64(hard, (__u8 *)fat16, fat16_size, seek)< 0) return -1;

return 0;

The root directory is read by the read_root_dentry() function:

int read_root_dentry()

U64 seek = (__u64)fbs.reserved * 512 + fat16_size * fbs.fats; // offset to the root directory from the beginning of the section

Root_size = 32 * dir_entries; // calculate the size of the root directory

dir_entry = (__u8 *)malloc(root_size);

If(!dir_entry) return -1;

Memset(dir_entry, 0, root_size);

If(pred64(hard, dir_entry, root_size, seek)< 0) return -1;

return 0;

Reading a cluster belonging to a file is performed by the read_cluster() function. The input parameters of the function are the cluster number cluster_num and a pointer to the __u8 *tmp_buff buffer where the reading result should be placed. The offset to the cluster on the partition is calculated by the formula (see):

SEEK = DATA_START + (CLUSTER_NUM - 2) * BYTE_PER_CLUSTER,

• SEEK– offset to a cluster on a partition
• DATA_START– start of data area
• CLUSTER_NUM– sequence number of the cluster
• BYTE_PER_CLUSTER– cluster size in bytes

int read_cluster(__u16 cluster_num, __u8 *tmp_buff)

U64 seek = (__u64)(byte_per_cluster) * (cluster_num - 2) + data_start; // calculate the offset to the cluster

< 0) return -1;

return 0;

The read_directory function reads the entries of a directory (not the root) and places the result in the memory area pointed to by the dir_entry pointer:

int read_directory(__u16 start_cluster)

Int i = 1;

U16 next_cluster;

For(; ;i++) (

We allocate memory to store the contents of the directory, read the contents of the starting cluster and get the value of the next cluster from the FAT16 table:

If(!dir_entry) return -1;

< 0) return -1;

Next_cluster = fat16;

Let's save the contents of the directory in a separate file (for control):

#ifdef DEBUG

Printf("Next cluster - 0x%X ", next_cluster);

Fat = open("dir16", O_CREAT|O_WRONLY, 0600);

Write(fat, dir_entry, root_size);

close(fat);

#endif

If the last cluster is reached, exit the loop, otherwise continue reading the directory by increasing the size of the dir_entry buffer by one more cluster:

If(next_cluster & EOF_FAT16) break;

start_cluster = next_cluster;

return 0;

The get_dentry() function performs a search in the contents of the directory for an element corresponding to the searched file. The input parameters of this function are a pointer to a struct split_name *sn structure containing the elements of the short file name:

Int i = 0;

The dir_entry global buffer contains an array of directory entries in which we are going to look for a file (or directory) entry. For search we organize a cycle. In the body of the loop, we copy the catalog elements into the global dentry structure and compare the value of the name and ext fields of this structure with the corresponding fields of the struct split_name *sn structure. The coincidence of these fields means that we have found an entry of the desired file in the array of directory elements:

for(; ; i++) (

If(!(memcmp(dentry.name, sn->name, sn->name_len)) &&

!(memcmp(dentry.ext, sn->ext, sn->ext_len)))

break;

If(!dentry.name) return -1;

#ifdef DEBUG

Printf("name - %s ", dentry.name);

Printf("start cluster - 0x%X ", dentry.start);

Printf("file size - %u ", dentry.size);

Printf("file attrib - 0x%X ", dentry.attr);

#endif

return 0;

All of the above code is located in the FAT16 directory, file fat16.c. To get the executable module, let's create a Makefile with the following content:

INCDIR = /usr/src/linux/include

PHONY=clean

Fat16: fat16.o split.o

Gcc -I$(INCDIR) $^ -g -o [email protected]

%.o: %.c

Gcc -I$(INCDIR) -DDEBUG -c $^

clean:

Rm -f *.o

Rm -f ./fat16

Software implementation of the algorithm for reading a file from a logical partition with the FAT12 file system

In general, the algorithm for reading a file from a FAT12 partition is identical to the algorithm for reading a file from a FAT16 partition. The difference lies in the procedure for reading elements from the FAT12 table. The FAT16 table was considered by us as a simple array of 16-bit elements. To read the elements of the FAT12 table, the following algorithm is proposed:

• multiply the element number by 1.5;
• extract a 16-bit word from FAT using the result of the previous operation as an offset;
• if the element number is even, perform an AND operation on the read word and mask 0x0FFF. If the number is odd, shift the word read from the table by 4 bits towards the least significant bits.

Based on this algorithm, we implement the function of reading elements from the FAT12 table:

int get_cluster(__u16 cluster_num)

U16 seek;

U16 cluster;

We calculate the offset in the FAT12 table and read a 16-bit word from the table:

Seek = (cluster_num * 3) / 2;

Memcpy((__u8 *)&clust, (__u8 *)(fat12 + seek), 2);

If the starting cluster number is an even number, we shift the value read from the table by 4 bits towards the lower bits, if it is odd, we add it with 0x0FFF:

If(cluster_num % 2) cluster >>= 4;

Else clust &= 0x0FFF;

This snippet can also be implemented in assembler:

" xorw %%ax, %%ax "

" btw $0, %%cx "

"jnc 1f"

" shrw $4, %%dx "

"jmp2f"

"1: andw $0x0FFF, %%dx "

"2: movw %%dx, %%ax "

:"=a" (next)

:"d" (clust), "c" (cluster_num));

We return the result:

return cluster;

Let's take a closer look at the algorithm itself. Assume that a file has been created on a FAT12 partition that occupies the 9th and 10th clusters. Each FAT12 element is 12 bits. Because we read 16-bit elements from the table, then the offset to the 9th element will be equal to 13 bytes (9 * 1.5 = 13, discard the remainder), while the lower 4 bits will belong to the 8th FAT element. They must be discarded, and for this it is enough to shift the read element by 4 bits towards the lower bits, which is provided by the algorithm. The offset to the 10th element will be 15 bytes, and the high 4 bits will belong to the 11th element of the FAT. To discard them, it is necessary to perform an AND operation on the 10th element and the mask 0x0FFF, which also corresponds to the above algorithm.

The source texts of the module for reading a file from a FAT12 partition are located in the FAT12 directory, file fat12.c.

Software implementation of the algorithm for reading a file from a logical partition with the FAT32 file system

The algorithm for reading a file from a partition with the FAT32 file system is practically the same as for FAT16, except that in FAT32 the root directory can be located anywhere on the partition and have an arbitrary size. Therefore, to make it more interesting, let's complicate the task - suppose that we only know the number of the partition with the FAT32 file system. To read information from this partition, you must first determine its coordinates - the offset to the partition from the beginning of the disk. And for this you need to have an idea about the logical structure of the hard drive.

The logical structure of the hard drive

Let's consider the logical structure of a hard drive that corresponds to the Microsoft standard - "main partition - extended partition - non-DOS partitions".

Hard disk space can be organized into one or more partitions, and partitions can contain one or more logical drives.

On the hard disk at the physical address 0-0-1 is the master boot record (Master Boot Record, MBR). The MBR structure contains the following elements:

• non-system bootloader (non-system bootstrap - NSB);
• disk partition description table (partition table, partition table, PT). It is located in the MBR at offset 0x1BE and occupies 64 bytes;
• MBR signature. The last two bytes of the MBR must contain the number 0xAA55.

The partition table describes the location and characteristics of the partitions on the hard drive. Disk partitions can be of two types - primary (primary, main) and extended (extended). The maximum number of primary partitions is four. The presence of at least one primary partition on the disk is mandatory. An extended partition can be divided into a large number of subsections - logical drives. A simplified structure of the MBR is presented in Table 7. The partition table is located at the end of the MBR, 16 bytes are allocated to describe the partition in the table.

Table 7. MBR Structure

Bias Size, bytes 0 446 0x1BE 16 0x1CE 16 0x1DE 16 0x1EE 16 0x1FE 2

The partition table entry structure is shown in Table 8.

Table 8. Structure of the partition table entry entry

The first byte in the section element is the section activity flag (0 - inactive, 0x80 - active). It serves to determine whether the partition is a system boot partition and whether it is necessary to boot the operating system from it when the computer starts. Only one section can be active. The partition activity flag is followed by the coordinates of the beginning of the partition - three bytes, indicating the head number, sector number and cylinder number. Cylinder and sector numbers are given in the interrupt format Int 0x13, i.e. bits 0-5 contain the sector number, bits 6-7 are the most significant two bits of the 10-bit cylinder number, bits 8-15 are the least significant eight bits of the cylinder number. Then follows the code identifier System ID, indicating that this partition belongs to one or another operating system. The identifier occupies one byte. Behind the system identifier are the coordinates of the end of the section - three bytes containing the numbers of the head, sector and cylinder, respectively. The next four bytes are the number of sectors before the partition, and the last four bytes are the size of the partition in sectors.

Thus, a partition table element can be described using the following structure:

struct pt_struct(

U8 bootable; // section activity flag

U8 start_part; // coordinates of the beginning of the section

U8 type_part; // system identifier

U8 end_part; // coordinates of the end of the section

U32 sect_before; // number of sectors before partition

U32 sect_total; // partition size in sectors (number of sectors in the partition)

The element of the primary partition immediately points to the boot sector of the logical disk (there is always only one logical disk in the primary partition), and the element of the extended partition points to the list of logical disks made up of structures called secondary MBR (Secondary MBR, SMBR).

Each disk in an extended partition has its own SMBR block. SMBR has a structure similar to MBR, but it does not have a boot record (filled with zeros), and only two of the four partition descriptor fields are used. The first element of the partition points to the logical drive, the second element points to the next SMBR structure in the list. The last SMBR in the list contains the section code zero in the second element.

Let's return to the consideration of the module for reading a file from a FAT32 partition.

Header files:

#include

#include

#include

#include

#include

MBR Signature:

#define SIGNATURE 0xAA55

Device file from which partition information will be read:

#define DEVICE "/dev/hda"

Partition table entry size (16 bytes):

#define PT_SIZE 0x10

The following array of structures maps a section's type code to its character mapping:

struct systypes (

U8 part_type;

U8 *part_name;

struct systypes i386_sys_types = (

(0x00, "Empty"),

(0x01, "FAT12"),

(0x04, "FAT16<32M"},

(0x05, "Extended"),

(0x06, "FAT16"),

(0x0b, "Win95 FAT32"),

(0x0c, "Win95 FAT32 (LBA)"),

(0x0e, "Win95 FAT16 (LBA)"),

(0x0f, "Win95 Ext"d (LBA)"),

(0x82, "Linux swap"),

(0x83, Linux)

(0x85, "Linux extended"),

(0x07, HPFS/NTFS)

Let's determine the number of elements in the i386_sys_types array using the PART_NUM macro:

#define PART_NUM (sizeof(i386_sys_types) / sizeof(i386_sys_types))

Set a limit on the number of logical drives:

#define MAX_PART 20

The following structure array will contain information about the logical drives on the device (hard drive):

struct pt_struct(

U8 bootable;

U8 start_part;

U8 type_part;

U8 end_part;

U32 sect_before;

U32 sect_total;

)pt_t;

inthard; // device file descriptor

U8mbr; // count MBR here

The number of the partition on which the FAT32 file system was created:

#define FAT32_PART_NUM 5

Boot sector, FSInfo sector and directory entry structures (defined in file ):

struct fat_boot_sector fbs;

struct fat_boot_fsinfo fsinfo;

struct msdos_dir_entry dentry;

U32 *fat32 = NULL; // copy FAT32 table here

U16 sector_size; // sector size (from FAT32)

U16 dir_entries; // 0 for FAT32

U16 sectors; // number of sectors per partition

U32 fat32_size; // FAT32 size

U32 data_start; // start of data area

U16 byte_per_cluster; // how many bytes are in the cluster (cluster size in bytes)

U32 next_cluster; // next cluster in the chain

U32 root_cluster; // ROOT cluster - initial cluster of the root directory

U8 *dir_entry = NULL; // pointer to directory entries

U64 start_seek = 0; // start offset to section (in bytes)

Main function:

int main()

int num = 0;

int cluster_num = 5; // how many clusters to read from file

U8 *full_path = "/Folder1/Folder2/readme"; // file to read

We open the device, get information about the partition table on the device and display information about the partitions:

Hard = open(DEV_NAME, O_RDONLY);

If(hard< 0) {

error(DEV_NAME);

Exit(-1);

If(get_pt_info(hard)< 0) {

error("get_pt_info");

Exit(-1);

Show_pt_info();

Calculate the starting offset to the partition:

Start_seek = (__u64)(pt_t.sect_before) * 512;

Read the clusters belonging to the file:

Num = fat32_read_file(full_path, cluster_num);

If(num< 0) perror("fat32_read_file");

Else printf("Read %d clusters\n", num);

close(hard);

return 0;

Information about the partition table is read by the get_pt_info() function:

int get_pt_info(int hard)

Int i = 0;

U64 seek;

We read the partition table from the MBR and check the signature:

Read_main_ptable(hard);

If(check_sign()< 0) {

Printf("Not valid signature!\n");

return -1;

We are looking for the identifier of the extended section. If there is one, we calculate the offset to the extended partition and read information about the logical drives:

for(;i< 4; i++) {

If((pt_t[i].type_part == 0xF) || \

(pt_t[i].type_part == 0x5) || \

(pt_t[i].type_part == 0x0C)) (

Seek = (__u64)pt_t[i].sect_before * 512;

Read_ext_ptable(hard, seek);

break;

return 0;

Partition table reading function read_main_ptable():

void read_main_ptable(int hard)

If(read(hard, mbr, 512)< 0) {

error("read");

close(hard);

Exit(-1);

Memset((void *)pt_t, 0, (PT_SIZE * 4));

Memcpy((void *)pt_t, mbr + 0x1BE, (PT_SIZE * 4));

return;

Signature check function check_sign():

int check_sign()

U16 sign = 0;

Memcpy((void *)&sign, (void *)(mbr + 0x1FE), 2);

#ifdef DEBUG

Printf("Signature - 0x%X\n", sign);

#endif

If(sign != SIGNATURE) return -1;

return 0;

Extended Partition Table Read Function:

void read_ext_ptable(int hard, __u64 seek)

int num = 4; // starting from this position, the array of pt_t structures will be filled with information about logical drives

U8 smbr;

Input data:

• hard– device file descriptor;
• seek– offset to the extended partition from the beginning of the disk (in bytes).

To obtain information about logical disks, we organize a loop:

For(;;num++) (

We read the SMBR located at the seek offset from the beginning of the disk:

memset((void *)smbr, 0, 512);

pred64(hard, smbr, 512, seek);

We fill in two elements of the pt_t table, starting from position num. The first element will point to the logical drive, and the second element will point to the following SMBR structure:

Memset((void *)&pt_t, 0, PT_SIZE * 2);

Memcpy((void *)&pt_t, smbr + 0x1BE, PT_SIZE * 2);

We make an amendment in the field "Number of the initial sector" - the countdown is from the beginning of the disk:

Pt_t.sect_before += (seek / 512);

If the partition type code is zero, then there are no more logical disks:

If(!(pt_t.type_part)) break;

Calculate the offset to the next SMBR:

Seek = ((__u64)(pt_t.sect_before + pt_t.sect_total)) * 512;

return;

The show_pt_info() function displays information about found logical drives on the device:

void show_pt_info()

Int i = 0, n;

#ifdef DEBUG

Printf("Number of partitions on disk - %d\n", PART_NUM);

#endif

For(; i< MAX_PART; i++) {

If(!pt_t[i].type_part) break;

Printf("\nPartition type %d - ", i);

For(n = 0; n< PART_NUM; n++) {

If(pt_t[i].type_part == i386_sys_types[n].part_type) (

Printf("%s\n", i386_sys_types[n].part_name);

break;

If(n == PART_NUM) printf("unknown type\n");

Printf("Boot flag - 0x%X\n", pt_t[i].bootable);

Printf("Sectors in section %d - %d\n", i, pt_t[i].sect_total);

Printf("Sectors before section %d - %d\n\n", i, pt_t[i].sect_before);

return;

Reading file clusters from a FAT32 partition is done by the fat32_read_file() function. This function has a lot in common with the fat16_read_file() function, so see point 6 for detailed comments:

int fat32_read_file(__u8 *full_path, int num)

Struct split_name sn;

U8 tmp_name_buff;

Int i = 1, n;

U32 start_cluster, next_cluster;

U8 *tmp_buff;

Preparatory operations - clear the buffer, structure and check the first slash:

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

If(full_path != "/") return -1;

Reading the boot sector:

If(read_fbs()< 0) return -1;

Memcpy((void *)§or_size, (void *)fbs.sector_size, 2);

Memcpy((void *)&dir_entries, (void *)fbs.dir_entries, 2);

Memcpy((void *)§ors, (void *)fbs.sectors, 2);

We read the FSInfo structure and display the signature in it:

If(read_fs_info()< 0) return -1;

Printf("Signature1 - 0x%X\n", fsinfo.signature1);

Printf("Signature2 - 0x%X\n", fsinfo.signature2);

Fat32_size = fbs.fat32_length * 512; // FAT32 size in bytes

data_start = 512 * fbs.reserved + fat32_size * 2; // start of data field

Byte_per_cluster = fbs.cluster_size * 512; // cluster size in bytes

root_cluster = fbs.root_cluster; // cluster number of the root directory

Read FAT32:

If(read_fat32()< 0) return -1;

Allocate memory for directory entries:

Dir_entry = (__u8 *)malloc(byte_per_cluster);

If(!dir_entry) return -1;

Reading the root directory:

If(read_directory(root_cluster)< 0) return -1;

We parse the full path of the file and separate each element into components:

While(1) (

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

For(n = 0 ; n< SHORT_NAME; n++, i++) {

tmp_name_buff[n] = full_path[i];

If((tmp_name_buff[n] == "/") || (tmp_name_buff[n] == "\0")) (

I++;

break;

tmp_name_buff[n] = "\0";

If(split_name(tmp_name_buff, &sn)< 0) {

Printf("not valid name\n");

return -1;

If(get_dentry(&sn)< 0) {

Printf("No such file!\n");

return -1;

To get the cluster start number in the FAT32 file system, you need to use the high word of the first cluster number of the file - the starthi field of the dentry structure:

Start_cluster = (((__u32)dentry.starthi<< 16) | dentry.start);

Checking the attribute byte:

If(dentry.attr & 0x10) ( // this is a directory

If(read_directory(start_cluster)< 0) return -1;

continue;

If(dentry.attr & 0x20) ( // and this is a file

tmp_buff = (__u8 *)malloc(byte_per_cluster);

N = open("clust", O_CREAT|O_RDWR, 0600);

If(n< 0) {

error("open");

return -1;

Printf("file`s first cluster - 0x%X .. ", start_cluster);

For(i = 0; i< num; i++) {

Memset(tmp_buff, 0, byte_per_cluster);

If(read_cluster(start_cluster, tmp_buff)< 0) return -1;

If(write(n, tmp_buff, byte_per_cluster)< 0) {

error("write");

return -1;

If(next_cluster == EOF_FAT32) (

Free(tmp_buff);

close(n);

Return ++i;

start_cluster = next_cluster;

Return i;

The purpose of the following three functions is to get the contents of the system area, i.e. boot sector, FSInfo structure and FAT32 table:

1) the read_fbs() function reads the boot sector:

int read_fbs()

If(pred64(hard, (__u8 *)&fbs, sizeof(fbs), start_seek)< 0) return -1;

return 0;

2) the read_fs_info() function reads the FSInfo structure:

int read_fs_info()

U64 seek = (__u64)fbs.info_sector * 512 + start_seek;

If(pred64(hard, (__u8 *)&fsinfo, sizeof(fsinfo), seek)< 0) return -1;

return 0;

3) the read_fat32() function reads the FAT32 table:

int read_fat32()

U64 seek = (__u64)fbs.reserved * 512 + start_seek;

Fat32 = (void *)malloc(fat32_size);

If(!fat32) return -1;

If(pred64(hard, (__u8 *)fat32, fat32_size, seek)< 0) return -1;

return 0;

The read_cluster() function reads the cluster with the specified number:

int read_cluster(__u32 cluster_num, __u8 *tmp_buff)

U64 seek = (__u64)(byte_per_cluster) * (cluster_num - 2) + data_start + start_seek;

If(pred64(hard, tmp_buff, byte_per_cluster, seek)< 0) return -1;

return 0;

Reading directories (including the root one) is handled by the read_directory() function:

int read_directory(__u32 start_cluster)

Int i = 2;

U32 next_cluster;

The function parameters are the starting catalog cluster. We read the contents of the directory into the dir_entry global buffer:

If(read_cluster(start_cluster, dir_entry)< 0) return -1;

Next_cluster = fat32;

If the directory occupies one cluster, exit, if not, increase the memory size and continue reading:

For(; ;i++) (

start_cluster = next_cluster;

Dir_entry = (__u8 *)realloc(dir_entry, i * byte_per_cluster);

If(!dir_entry) return -1;

If(read_cluster(start_cluster, (dir_entry + (i - 1) * byte_per_cluster))< 0) return -1;

Next_cluster = fat32;

If((next_cluster == EOF_FAT32) || (next_cluster == 0xFFFFFF8)) return 0;

return 0;

The last function we'll look at searches the contents of a directory for an element that matches the file we're looking for:

int get_dentry(struct split_name *sn)

Int i = 0;

The dir_entry pointer is set to a memory area containing an array of directory entries in which we are going to look for a file (or directory). To search, we organize a loop and place the found entry in the global dentry structure:

For(;;i++) (

Memcpy((void *)&dentry, dir_entry + i * sizeof(dentry), sizeof(dentry));

If(!(memcmp(dentry.name, sn->name, sn->name_len)) &&

!(memcmp(dentry.ext, sn->ext, sn->ext_len)))

break;

If(!dentry.name) return -1;

return 0;

This concludes our consideration of the module for reading a file from a FAT32 partition.

The source code of the module is located in the FAT32 directory, file fat32.c.

Differences in the organization of storing records about files in directories for FAT and EXT2 file systems

A few words about the differences in the organization of storing records about files in directories for FAT and EXT2 file systems. The structure of the EXT2 file system has been covered in .

We just got acquainted with FAT - in it all elements of the directory have a fixed value. When creating a file, the file system driver looks for the first empty position and fills it with information about the file. If the length of the directory does not fit in one cluster, then another cluster is allocated for it, and so on.

Consider how things are in EXT2.

Suppose we have a partition with the EXT2 file system, the block size is 4096 bytes. In this section, we create a directory. The directory size will be equal to the block size - 4096 bytes. In the directory, the operating system immediately creates two entries - an entry for the current directory and an entry for the parent directory. The current directory entry will take 12 bytes, while the parent directory entry will be 4084 bytes long. Let's create a file in this directory. After that, there will be three entries in the directory - the current directory entry is 12 bytes long, the parent directory entry is already 12 bytes long, and the created file entry is, you guessed it, 4072 bytes long. If we delete the created file, the length of the parent directory entry will increase again to 4084 bytes.

Thus, when creating a file, the EXT2 file system driver looks in the directory for an entry of the maximum length and splits it, allocating space for a new entry. Well, if there is still not enough space, one more block is allocated for the directory, and the length of the directory becomes equal to 8192 bytes.

And in conclusion - a small edit to the article "Architecture of the EXT2 file system".

This edit concerns the get_i_num() function for determining the inode number from the filename. The old version of this function looked like this:

int get_i_num(char *name)

int i = 0, rec_len = 0;

Struct ext2_dir_entry_2dent;

For(; i< 700; i++) {

If(!memcmp(dent.name, name, dent.name_len)) break;

Rec_len += dent.rec_len;

Return dent.inode;

Corrected version:

int get_i_num(char *name)

* Function parameter - file name. The return value is the inode number of the file.

int rec_len = 0;

Struct ext2_dir_entry_2dent; // this structure describes the format of the root directory entry:

* The global buffer buff contains an array of directory entries. To determine the inode number of a file, you need to find

* in this array is an entry with the name of this file. To do this, we organize a cycle:

For(;;) (

/* Copy the directory entries into the dent structure: */

Memcpy((void *)&dent, (buff + rec_len), sizeof(dent));

* A filename length of zero means that we have iterated over all directory entries

* and entries with the name of our file were not found. So it's time to go back:

If(!dent.name_len) return -1;

/* The search is done by comparing filenames. If the names match, exit the loop: */

If(!memcmp(dent.name, name, strlen(name))) break;

/* If the names don't match, move to the next entry: */

Rec_len += dent.rec_len;

/* If successful, return the inode number of the file: */

Return dent.inode;

Literature:

1. V. Kulakov. Programming at the hardware level: a special reference. 2nd ed. / - St. Petersburg: Peter, 2003 - 848 p.
2. A.V.Gordeev, A.Yu.Molchanov. System software / - St. Petersburg: Peter - 2002
3. Meshkov V. Architecture of the ext2 file system. - Magazine "System Administrator", No. 11 (12), November 2003 - 26-32 p.

In contact with

FAT - File Allocation Table - This term refers to one of the ways in which a file system is organized on a disk. This table stores information about files on the hard drive as a sequence of numbers that specifies where each part of each file is located. With its help, the operating system finds out which clusters the required file occupies. FAT is the most common file system and is supported by the vast majority of operating systems. At first, FAT was 12-bit and allowed you to work with floppy disks and logical drives with a capacity of no more than 16 MB. In MS-DOS version 3.0, the FAT table became 16-bit to support larger drives, and a 32-bit FAT table is used for drives up to 2047 GB.

FAT32 is a newer file system based on the FAT format and is supported by Windows 95 OSR2, Windows 98, and Windows Millennium Edition. FAT32 uses 32-bit cluster IDs, but reserves the upper 4 bits, so the effective cluster ID size is 28 bits. Since the maximum size of FAT32 clusters is 32 KB, FAT32 can theoretically handle 8 terabyte volumes. Windows 2000 limits the size of new FAT32 volumes to 32 GB, although it does support existing larger EAT32 volumes (created on other operating systems). The larger number of clusters supported by FAT32 allows it to manage disks more efficiently than FAT 16. FAT32 can use 512-byte clusters for volumes up to 128 MB.

The FAT 32 file system in Windows 98 is used as the default. This operating system comes with a special disk conversion program from FAT 16 to FAT 32. Windows NT and Windows 2000 can also use the FAT file system, and therefore you can boot your computer from a DOS disk and have full access to all files. However, some of the most advanced features of Windows NT and Windows 2000 are provided by its own ntfs (NT File System) file system. ntfs allows you to create disk partitions up to 2 TB (like FAT 32), but, in addition, it has built-in file compression, security and auditing functions that are necessary when working in a network environment. And in Windows 2000, support for the FAT 32 file system is implemented. The installation of the Windows NT operating system begins on a FAT disk, but at the end of the installation, the data on the disk can be converted to ntfs format at the end of the installation.

You can also do this later using the Convert.exe utility that comes with the operating system. A disk partition converted to ntfs becomes inaccessible to other operating systems. To return to DOS, Windows 3.1, or Windows 9x, you need to remove the ntfs partition and create a FAT partition instead. Windows 2000 can be installed on a FAT 32 and ntfs drive.

The capabilities of EAT32 file systems are much broader than those of FAT16. Its most important feature is that it supports disks up to 2047 GB and works with smaller clusters, thereby significantly reducing the amount of wasted disk space. For example, a 2 GB hard drive in FAT16 uses 32 KB clusters, while FAT32 uses 4 KB clusters. To maintain compatibility with existing programs, networks, and device drivers wherever possible, FAT32 is implemented with minimal changes to the architecture, APIs, internal data structures, and disk format. But, since the size of the FAT32 table elements is now four bytes, many internal and disk data structures, as well as APIs, had to be revised or extended. Certain APIs on EAT32 drives are blocked to prevent legacy disk utilities from corrupting the contents of FAT32 drives. Most programs will not be affected by these changes. Existing tools and drivers will work on FAT32 drives as well. However, MS-DOS block device drivers (such as Aspidisk.sys) and disk utilities need to be modified to support FAT32. All disk utilities supplied by Microsoft (Format, Fdisk, Defrag, and ScanDisk for real and protected modes) have been redesigned to fully support FAT32. In addition, Microsoft is helping leading vendors of disk utilities and device drivers modify their products to support FAT32. FAT32 is more efficient than FAT16 when working with larger disks and does not require them to be partitioned into 2 GB partitions. Windows 98 necessarily supports FAT16, since it is this file system that is compatible with other operating systems, including third-party companies. In real mode MS-DOS and Windows 98 safe mode, the FAT32 file system is significantly slower than FAT16. Therefore, when running programs in MS DOS mode, it is desirable to include in the Autoexec.bat file or PIF file a command to load Smartdrv.exe, which will speed up disk operations. Some older FAT16 programs may report incorrect information about the amount of free or total disk space if it is more than 2 GB. Windows 98 provides new APIs for MS-DOS and Win32 that allow these metrics to be correctly determined. In table. 1 shows the comparative characteristics of FAT16 and FAT32.

Table 1. Comparison of FAT16 and FAT32 file systems

The maximum possible file length in FAT32 is 4 GB minus 2 bytes. Win32 applications can open files of this length without special processing. Other applications should use interrupt Int 21h, function 716C (FAT32) with open flag equal to EXTEND-SIZE (1000h).

In the FAT32 file system, 4 bytes are allocated for each cluster in the file allocation table, while in FAT16 - 2 bytes, and in FAT12 - 1.5 bytes.

The upper 4 bits of the 32-bit FAT32 table entry are reserved and do not participate in the formation of the cluster number. Programs that directly read the PAT32 table must mask these bits and prevent them from being changed when new values ​​are written.

So, FAT32 has the following advantages over previous implementations of the FAT file system:

supports drives up to 2 TB;

organizes disk space more efficiently. FAT32 uses smaller clusters (4 KB for drives up to 8 GB), which saves up to 10-15% of space on large drives compared to FAT;

the FAT 32 root directory, like all other directories, is now unlimited, it consists of a chain of clusters and can be located anywhere on the disk;

has higher reliability: FAT32 is able to move the root directory and work with a FAT backup, in addition, the boot record on FAT32 drives has been expanded to include a backup of critical data structures, which means that FAT32 drives are less sensitive to the occurrence of separate bad patches than existing FAT volumes;

programs load 50% faster.

Table 2. Comparison of cluster sizes

An advanced disk defragmentation utility optimizes the placement of application files loaded at the time of its launch. It is possible to convert a drive to EAT32 using the Drive Converter (FAT32) utility, but after that it is recommended to run the Disk Defragmenter utility, otherwise the computer will work with the drive more slowly than before. When using FAT32, alternate boot configuration of Windows 98 and Windows NT 4.0 becomes impossible because the latter does not support FAT32. FAT32 allocates disk space much more economically than previous versions of the FAT file system. This frees up tens or even hundreds of megabytes on large drives, and when combined with an advanced FAT32 disk defragmentation utility, significantly reduces application load times. The procedure for converting the file system on a hard drive to FAT32 using Drive Converter (FAT32) is quite simple. To do this, you must sequentially open the Start menu (Start), submenu programs (Programs), Accessories (Standard), System Tools (Utilities) and select the Drive Converter (FAT32) command (Converting the disk to FAT32). The conversion may affect the hibernate features (save computer state to disk) provided on many computers. Systems in which the sleep mode is implemented through the APM BIOS or ACPI (Advanced Configuration and Power Interface) S4 / BIOS must support FAT32 - only then will they work correctly in Windows 98.

Most BIOS manufacturers include virus protection tools that monitor changes to the MBR (Master Boot Record) in the BIOS. In addition, legacy anti-virus utilities installed as resident programs or real-mode drivers may detect the MBR change when MS-DOS boots. Since conversion to FAT32 inevitably modifies the MBR, some virus scanners may erroneously interpret this as a sign of a system infection. Therefore, if an anti-virus utility detects a change in the MBR, it offers to "cure" it. It is best to uninstall your antivirus software and disable the antivirus built into the BIOS before converting the drive to FAT32. Then you can reinstall the antivirus utility and activate the virus protection built into the BIOS.