A “Walk Through” Experiment

Slides:



Advertisements
Similar presentations
1 The FAT File System A Walk Through Experiment Jerry Breecher November, 2008.
Advertisements

Operating Systems File Management.
Chapter 4 : File Systems What is a file system?
File Systems Examples.
G53OPS Operating Systems Graham Kendall File Systems.
In this assignment you are going to read floppy disk. You can run ‘mdir’ Unix function to see what output your program should give. FAT-12 MS-DOS file.
The FAT File System CSC 414. Objectives  Understand the structure and components of the FAT (12/16/32) File Systems  Understand what happens when a.
Digital Forensics Module 11 CS /26/2004Module 112 Outline of Module #11 Overview of Windows file systems Overview of ProDiscover Overview of UNIX.
Lecture 10: The FAT, VFAT, and NTFS Filesystems 6/17/2003 CSCE 590 Summer 2003.
Ceng Operating Systems
Files & Partitions BACS 371 Computer Forensics. Data Hierarchy Computer Hard Disk Drive Partition File Physical File Logical File Cluster Sector Word.
BACS 371 Computer Forensics
Implementing Hard Drives Chapter 10
1 Partitioning a Hard Drive ©Richard Goldman Revised January 8, 2001 Revised December 9, 2002.
FAT Structure. File Allocation Table (FAT) File Systems Used with all flavors of Windows Supported by all Windows and UNIX varieties Used in flash cards.
Mastering Windows Network Forensics and Investigation Chapter 7: Windows File Systems.
Lecture 9: The FAT and VFAT Filesystems 6/16/2003 CSCE 590 Summer 2003.
Mastering Windows Network Forensics and Investigation Chapter 7: Windows File Systems.
Bits, Bytes, Files, Hard Drives. Bits, Bytes, Letters and Words ● Bit – single piece of information ● Either a 0 or a 1 ● Byte – 8 bits of information.
File System Management File system management encompasses the provision of a way to store your data in a computer, as well as a way for you to find and.
Windows NTFS Introduction to Operating Systems: Module 15.
The disk surface is divided into tracks. into tracks. 1.
ENGI 3655 Lab Sessions 1Richard Khoury.  Linked Allocation ◦ Section Richard Khoury2.
Chapter 3 Partitioning Drives using NTFS and FAT32 Prepared by: Khurram N. Shamsi.
A+ Guide to Managing and Maintaining Your PC Fifth Edition Chapter 7 Floppy Drives.
The Functions of Operating Systems Desktop PC Operating Systems.
File Storage Organization The majority of space on a device is reserved for the storage of files. When files are created and modified physical blocks are.
DISK THEORY. Disk Theory n How information is stored on disk n How we can take advantage of that when bad things happen.
1 Floppy Drive Formatting ©Richard Goldman February, 2001.
Lecture 18 Windows – NT File System (NTFS)
OPERATING SYSTEMS Frans Sanen.  Analyze a FAT file system manually  FAT12 first and simplest version  Still used on smaller disks (e.g. floppies) 
University of Pennsylvania 10/31/00CSE 3801 Windows File System - FAT originally invented as a method for storing data on floppy disks. later used by MS-DOS.
FAT File Allocation Table
Lecture 10 Page 1 CS 111 Summer 2013 File Systems Control Structures A file is a named collection of information Primary roles of file system: – To store.
BOOT SECTOR, RDE AND FAT ANALYSIS AND STUDY. FLOPPY CONSTRUCTION 1.Write - Protect Notch. 2.Hub. 3.Shutter. 4.Outer Jacket. 5.Protective Woolen Film.
File system In computing, a file system is a method of storing and organizing computer files and the data they contain to make it easy to find and access.
Computer Forensics Hard Drive Format.
NTFS Filing System CHAPTER 9. New Technology File System (NTFS) Started with Window NT in 1993, Windows XP, 2000, Server 2003, 2008, and Window 7 also.
Digital Forensics Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #8 File Systems September 22, 2008.
Chapter 8 File Systems FAT 12/16/32. Defragmentation Defrag a hard drive – Control Panel  System and Security  Administration tools  Defrag hard drive.
File Systems May 12, 2000 Instructor: Gary Kimura.
BITS Pilani Pilani Campus Pawan Sharma Lecture ES C263 INSTR/CS/EEE F241 Microprocessor Programming and Interfacing.
SVBIT SUBJECT:- Operating System TOPICS:- File Management
Master Boot Record (MBR)
UMBC CMSC 421 Spring 2017 The FAT Filesystem.
Chapter 11: File System Implementation
File System Structure How do I organize a disk into a file system?
Chapter 11: File System Implementation
Windows XP File Systems
Filesystems.
Memory chips Memory chips have two main properties that determine their application, storage capacity (size) and access time(speed). A memory chip contains.
Partitioning a Hard Drive
File Management.
EECE.4810/EECE.5730 Operating Systems
Chapter 11: File System Implementation
File Managements.
CS510 Operating System Foundations
Chapter 11: File System Implementation
EECE.4810/EECE.5730 Operating Systems
Files Management – The interfacing
Modern PC operating systems
Disk Structure Analysis
Sector 25 from the Root Directory (in 32 byte chunks)
Chapter 11: File System Implementation
Partitioning & Formatting
File system : Disk Space Management
Department of Computer Science
Lecture Topics: 11/20 HW 7 What happens on a memory reference Traps
FAT File System.
Chapter 5 File Systems -Compiled for MCA, PU
Presentation transcript:

A “Walk Through” Experiment The FAT File System A “Walk Through” Experiment Jerry Breecher

The FAT File System Why would anyone care about FAT today? Because it’s something we can easily understand. It’s easy to walk our way around a floppy disk and see everything we need to see. Has great educational value. It embodies all the aspects of any other file system: Booting mechanism Sector Allocation mechanism File definition mechanism –holds all the properties of a file you need to know; name, dates, permissions.

The FAT File System File Allocation Table (FAT) is a file system developed by Microsoft for MS-DOS and was the primary file system for consumer versions of Microsoft Windows up to and including Windows Me. The FAT file system is relatively uncomplicated, and is supported by virtually all existing operating systems for personal computers. This ubiquity makes it an ideal format for floppy disks and solid-state memory cards, and a convenient way of sharing data between disparate operating systems installed on the same computer (a dual boot environment). The most common implementations have a serious drawback in that when files are deleted and new files written to the media, directory fragments tend to become scattered over the entire media, making reading and writing a slow process. Defragmentation is one solution to this, but is often a lengthy process in itself and has to be performed regularly to keep the FAT file system clean.

The FAT File System There are 3 versions of FAT: FAT-12, FAT-16, and FAT-32. These numbers refer to the number of bits available to define clusters. The floppy disk we’re looking at uses FAT-12, and so is limited to 212 or approximately 4096 clusters. (In fact, the number is less than this, since 000h and 001h are not used and FF0h to FFFh are reserved or used for other purposes, leaving 002h to FEFh (2 to 4079) as the range of possible clusters. ) A cluster is made up of 4 sectors (the minimum size that can be allocated.) A sector is 512 bytes  a Cluster is 2048 bytes. So Fat-12 has a maximum of 4078 clusters * 2048 bytes/cluster = 8 Megabytes A normal 1.4 Mbyte PC floppy disk has 80 tracks, containing 18 sectors, and may hold 720 Kbytes of data on each side (80 x 18 x 512 bytes). Here’s the TRUTH about our disk structure. Since it’s only necessary to support 1.4 Megabytes, this disk seems to have a cluster = 1 Sector.

The FAT File System For this exercise, a number of files have been placed on a Floppy Disk and then the structure of the floppy was examined using BPSoft’s Hexworkshop (http://www.hexworkshop.com/ ) disk editor (they have a nice trial version you might want to use.) I have downloaded the output of Hexworkshop running on the floppy and included it as part of this package. On the next few pages, you can see the files that were created. We will be able to examine the structure of the disk and answer the following questions: The boot sector. How does an OS start up a disk? Directories – we have here a root directory ( A:\ ) and also a sub directory (A_Dir.) Within a Directory, how are filenames laid out? How does FAT manages files containing one cluster and many clusters? How does FAT manage short and long filenames? What does the FAT look like? What do the contents of a file look like?

Directory Structure Here are the contents of this disk: A_Dir FileInSubdir File1 File2 ThisIsAFileWithAVeryLongName The following structure was added to the floppy. This must be done very carefully since Windows has a way of keeping many temporary files around and the names of these files, even if deleted would mess up our simple picture.

Disk Structure Here’s the overall structure of the disk. Note that all addresses are given in both Decimal and Hexadecimal. Generally we’ll use Hex along the way here. Sector Number Sector Number (Hex) What it does Boot Track contains information about the disk, plus code that’s run by the BIOS when the disk is started up. 1st File Allocation Table (FAT) 1 - 9 Information on what clusters are allocated on the disk. 2nd File Allocation Table (FAT) 10 - 18 0Ax – 12x Redundant information on what clusters are allocated on the disk. Root Disk Directory 19 - 32 13X – 20X Information about the characteristics of the directories and files. File / Directory Data Area 33 - 2879 21X - B3Fx The contents of the files and Directories

Sector 000x Location # Bytes Meaning Value 01E OS Boot Loader 01C 2 # Hidden Sectors 01A # Heads 018 # Sectors / Track 18 (12x) 016 # sectors/ FAT 9 015 1 Media Bytes F0: (floppy) 013 # logical sectors 2880(0B40x) 011 # Root Dir entries 224 (00E0x) 010 # FATS 00E # Boot Sectors 00D # Sectors/Cluster 00B # Bytes/Sector 512 (0200x) 003 8 OEM Name ID MSDOS5.0 000 3 Jmp to loader EB 3C 90

File Allocation Table Reminder – a FAT is a way of keeping track of what Sectors are in use. A FAT entry (3 nibbles) in general has one of three values: A “0” – it’s unused and available. A Pointer to the next Sector allocated for this file. A “FFF” indicating the end of the pointer chain – this is the last sector allocated for this file. Sectors 1 – 9 contain the 1st FAT. Sectors A – 12 contain the 2nd FAT. These are redundant and should contain identical information.

File Allocation Table Sectors 1 – 9 contain the 1st FAT. Sectors A – 12 contain the 2nd FAT. These are redundant and should contain identical information. Here are the rules for FAT entries: On floppies, each 12 bit number in the FAT records a cluster belonging to a particular file. A 12 bit value means an entry can range from zero to 4096 ($FFF). This is where FAT-12 comes from. If a FAT entry is zero, then the associated cluster is unused and available. If an entry is 4081 to 4087 ($FF1 to $FF7), then the cluster is unusable due to a formatting error (usually a bad sector). If the entry contains 4088 to 4095 ($FF8 to $FFF), then the cluster contains the end of a file and does not point to another. 12-bit entries can be hard to read; sorry about that.

Sector 001x 0 1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 F0 FF FF FF FF FF FF 6F 00 07 80 00 09 A0 00 0B F0 FF FF 0F 00 Cluster 2 3 4 These files have a single sector Cluster A: Aims at Cluster B Cluster C: Last Sector (FFF) Cluster 7: Aims at Cluster 8 Cluster 9: Aims at Cluster A Cluster 6: Aims at Cluster 7 FF FF Padding Cluster B: Last Sector (FFF) Cluster 5: Aims at Cluster 6 Cluster 8: Aims at Cluster 9 F0 means it’s a floppy.

Sector 00Ax This is the second FAT – identical to the first. Starting Cluster Contains (Points to) What does it hold? 2 FFF ( one sector only) (021x) A_Dir -- Directory 3 (022x) File in directory A_Dir 4 (023x) File1 (single sector) 5 6  7  8  9  A  B  FFF (024x-02Ax) Multisector file C (02Bx) File with long name

Directory Information Directory Entries hold information about the files or directories that are in that directory. Below is the format for a directory entry. Attribute Offset Number of bytes in field Filename 8 Filename Extension 3 File Attributes B 1 reserved C 10 Creation Time 16 2 Creation Date 18 Pointer to cluster in FAT 1A File Length 1C 4 See the next page for additional information about many of these fields.

Directory Information Attribute Offset Number of bytes in field Filename 8 Filename Extension 3 File Attributes B 1 reserved C 10 Creation Time 16 2 Creation Date 18 Pointer to cluster in FAT 1A File Length 1C 4 First byte of filename: $00 – unused $E5 – file erased $2E – subdirectory file Attributes: bit 0 – read only bit 1 – hidden file bit 2 – system file bit 3 – volume label bit 4 – subdirectory bit 5 – archive bit bits 6, 7 -- unused Creation Time: bits 0 – 4 – seconds/2 (0 – 29) bits 5 – 10 – minutes ( 0 – 59) bits 11 – 15 – hours ( 0 – 23 ) Creation Date: bits 0 – 4 – date (1 – 31) bits 5 – 8 – month ( 1 - 12) bits 9 – 15 – year since 1980

Number of bytes in field Root Directory Sector 013x Attribute Offset Number of bytes in field Example Filename 8 File2 Filename Extension 3 --- File Attributes B 1 20 reserved C 10 Creation Time 16 2 “03 79” Creation Date 18 “65 39” Pointer to cluster in FAT 1A 5 File Length 1C 4 0D23

Sector 021x This contains the contents of the subdirectory, A_Dir. Note that the format of a file entry is the same as for the root directory.

Sector 022x This contains the contents of the file AFileInTheSubdirectory. Notice that it’s ALL data – no information about the file itself is kept in the data sectors. There is no reason for the OS to interpret this sector in any fashion.

Sector 023x This contains the contents of the file File1. Notice that it’s ALL data – no information about the file itself is kept in the data sectors. There is no reason for the OS to interpret this sector in any fashion.

Sector 024x This contains the contents of the file File2. This is a larger file and the data goes on for several sectors, from 024x to 02Ax.

Sector 02Ax

Sector 02Bx This contains the contents of the file ThisIsAFileWithALongFilename. As you can see, it’s a relatively small file containing 2Dx bytes.

Sector 02Cx This sector has been formatted with F6 but there is no data in it. It’s ready to be allocated since it’s cluster location in the FAT has a 0 in it.