FAT32 in Hex

1 Layout of a FAT32 volume

A FAT32 volume has three regions. Their sizes are all in the boot sector:

Reservedboot sector, FSInfo, backup boot sector

FAT #1one 32-bit entry per cluster

FAT #2copy

Data regionclusters 2, 3, 4, … (directories and file contents)

FAT #1 = volume start + reserved sectors × 512 data region = FAT #1 + number of FATs × sectors per FAT × 512 cluster N = data region + (N − 2) × sectors per cluster × 512

Cluster numbering starts at 2, because FAT entries 0 and 1 are reserved. The sample disk below has one partition starting at sector 2048 (byte 0x100000) and uses one sector (512 bytes) per cluster to keep things small. Real sticks use 4–32 KiB clusters.

Facts about this sample disk

2 The boot sector

The first sector of the volume. Bytes 0x0B–0x5A are the BIOS Parameter Block (BPB): every number you need to find the other regions. Work out FAT #1 and the data region from it with the formulas above, then check your result in the sections below.

Sector 1 holds FSInfo, a cache of the free-cluster count and the next free cluster. Both are hints only, but "next free" roughly points at the most recent write.

Sector 6 holds a backup of the boot sector. It should be byte-identical to sector 0.

3 The File Allocation Table

The FAT is a linked list of clusters stored as an array: entry N says what comes after cluster N. 0 means free, 0x0FFFFFF8–0x0FFFFFFF means "last cluster of this file", and any other value is the next cluster number.

Clusters 5 → 6 → 7 form one chain, the 1,350-byte file with the long name (3 × 512 bytes). Clusters 8 and 9 show as free, but the directory below still has an entry pointing to cluster 8.

The FAT tells you nothing about names. It doesn't even say where a chain starts. The start comes from the directory entry, so you always read the directory first and then follow the chain.

4 Directory entries

A directory is a file made of 32-byte entries. The root directory starts at the cluster given in the boot sector (normally 2). Each entry holds the 8.3 name, attributes, timestamps, the first cluster (split into a high word at 0x14 and a low word at 0x1A) and the size.

first cluster = high word × 65536 + low word time = hours (5 bits) | minutes (6) | seconds ÷ 2 (5) date = years since 1980 (7 bits) | month (4) | day (5)

Long file names and deleted entries

Names that don't fit 8.3 get extra LFN entries (attribute 0F) placed before the short entry, in reverse order. Each carries 13 UTF-16 characters and a checksum of the short name.

When a file is deleted, FAT only changes two things: the first byte of each of its entries becomes E5, and its chain in the FAT is set to 0. The rest of the entry stays, and so do the data clusters until something overwrites them.

Look at the deleted entry: the name lost its first character, but the first cluster (8) and the size (684 bytes) are still there. Follow the → First cluster row: the content is still on disk. The FAT, however, no longer says which clusters belonged to the file.

5 Try it yourself

Answer from the hex views above. Numbers can be typed in decimal or hex (0x…).

How many sectors does one FAT occupy on the sample volume?

It is a 4-byte little-endian number in the FAT32 extended BPB, at offset 0x24 of the boot sector.

Bytes 0x24–0x27 are 10 02 00 00. Read little-endian: 0x00000210 = 528 sectors.

At which byte offset of the disk does FAT #1 start?

Volume start + reserved sectors × 512. The volume starts at sector 2048.

Volume start = 2048 × 512 = 0x100000. Reserved sectors (offset 0x0E) = 20 00 = 32.

FAT #1 = 0x100000 + 32 × 512 = 0x100000 + 0x4000 = 0x104000 (1,064,960).

At which byte offset does the data region (cluster 2) start?

Data region = FAT #1 + number of FATs × sectors per FAT × 512.

2 FATs × 528 sectors × 512 bytes = 540,672 = 0x84000.

0x104000 + 0x84000 = 0x188000. The root directory widget above starts exactly there.

At which byte offset does the content of HELLO.TXT start?

Find its first cluster in the root directory (high word at 0x14, low word at 0x1A of its entry), then use the cluster formula.

The entry at root +0x40 has high word 00 00 and low word 04 00: cluster 4.

Cluster 4 = 0x188000 + (4 − 2) × 1 × 512 = 0x188400.

These are the 32 bytes of the HELLO.TXT directory entry. Edit them and watch the decoded entry below:

Set the first byte (48, "H") to E5. The entry is now shown as deleted.
Change the file size at +0x1C to 00 02 00 00. How many bytes is that?
The modified time at +0x16 is 00 54 (0x5400 = 10:32:00). Change the first byte to 01, then the second byte to 55. Which part of the time changes each time, and why?