OPERATING SYSTEMS Frans Sanen

 Analyze a FAT file system manually  FAT12 first and simplest version  Still used on smaller disks (e.g. floppies)  FAT16 & FAT32 as successors (essentially the same, but more complex)  De facto USB stick standard  Resources  Microsoft’s general overview of FAT export)  Links from the assignment 2

 Hex editor  Program that allows us to manipulate binary computer files   XVI-32  ASCII table    29#Tabel_van_ASCII-codes 29#Tabel_van_ASCII-codes 3

 Verify the MD5 checksum of the image  Linux: md5sum  Windows  hksfv (via Google)  4

 Floppy Disk  Directories  FAT12  Removing files 5

 Floppy Disk  Directories  FAT12  Removing files 6

 Structure of a FAT12 formatted floppy disk PositionLengthContents 01Boot sector 19Fat 1 109Fat Root directory Data 7

 Sector size is 512B or ½ KB  2880 sectors in total (= )  2880 * 1/2 KB = 1440 KB = 1,4 MB  Fat 2 is a copy of Fat 1  Root directory contains the directory entries

 Isolate the different parts for the floppy image (fat12.img) by using a hex editor  Find the (hexadecimal) start addresses for every part 9

 Floppy Disk  Directories  FAT12  Removing files 10

 Floppy Disk  Directories  FAT12  Removing files 11

 Directory in FAT12 is a sequence of file descriptions  Every file description consists of 32 bytes Note: hexadecimal number is a quick way to write 4 binary numbers 12

PositionLengthContents 08Name 83Extension 111Attribute 1210Reserved 222Time 242Date 262First cluster 284File size 13

b 5a b5a330300b  Name: first 8 bytes  Can be looked up in ASCII table  Spaces are used as padding TEST____

15

b 5a b5a330300b  Extension: next 3 bytes  Can be looked up in ASCII table  Spaces are used as padding DD_

b 5a b5a330300b  Attribute: kept in a bitvector  Little endian byte order: least significant byte first  E.g. 4A 3B 2C 1D (hexadecimal) is stored as 1D 2C 3B 4A

0read-only4subdir 1hidden5archive 2system file6/ 3volume label7/ 18

b 5a b5a330300b  Attribute: 12th byte  20 hexadecimal  32 decimal  in bits (little endian) Hence... archive!

b 5a b5a330300b  Reserved: next 10 bytes  Creation time and date  Last accessed

b 5a b5a330300b  Time: next 2 bytes (after reserved part)  851b  1b85  1b = 27 =  85 = 133 =  So:

22   Hours: 5 bits  or 3  Minutes: 6 bits  : 28  Seconds: 5 bits (only even seconds!)  00101: 5  10  So... 3h 28m 10s

b 5a b5a330300b  Date: next 2 bytes (after time)  5a33  335a  33 = 51 =  5a = 90 =  So:

24   7 bits for the number of years since 1980  : 25  4 bits for the month  1010: 10  5 bits for the day  11010: 26  So... October 26, 2005

b 5a b5a330300b  First cluster: next 2 bytes (after date)  Sequence number of the first cluster of the file  0300  0003 (hexadecimal)  So: cluster 3

b 5a b5a330300b  File size: last 4 bytes  B  b0  So: 1200 bytes

 Interpret the following directory entry  Visualize the contents of the root directory of fat12.img by giving the name, size and date of each entry. 5a b c a a

 Floppy Disk  Directories  FAT12  Removing files 28

 Floppy Disk  Directories  FAT12  Removing files 29

 Directory-entry contains the cluster where the file starts (first cluster value is FAT index)  FAT indexes 0 and 1 are unused, so  FAT index 3 matches data cluster 1  FAT index 240 matches data cluster 238  FAT-table gives us the other clusters that potentially are used by the file 30

 The FAT contains a 12-bit element for every cluster  FAT12 So… 2 FAT elements can be saved in 3 bytes E.g. AB CD EF contains both DAB and EFC (AB CD EF  BA DC FE  DAB and EFC) 31

000Free cluster 002-FEFUsed cluster + value pointing to next cluster FF0-FF6Reserved FF7Bad cluster FF8-FFFUsed cluster + last cluster of file 32

 F0 FF FF F0 FF becomes (FOF FFF) FFF or clusters 3, 4 and 5 are in use (cluster 2 is free)  Remember the file size of 1200 bytes? Now we know that the file is stored in 3 clusters: (3 x 512) – 1200 or 336 bytes of slack space (i.e. lost space due to internal fragmentation loss) 33

 Clusters 3, 4 and 5 match with data blocks 1, 2 and 3  How to find where a data block starts?  Start address data blocks: 4200 (H)  Cluster 1 starts after 1 x 512 bytes or 200 (H) Hence, 4400 is the hexadecimal start address. 34

 Find all clusters of the file sum.xls on fat12.img and reconstruct the file 35

 Floppy Disk  Directories  FAT12  Removing files 36

 Floppy Disk  Directories  FAT12  Removing files 37

 Find out what happens when a file is removed. How can you see this on the floppy?  Is it possible to undelete a file? How? If yes, are there limitations? 38