We have now made several references variously to FAT16, FAT32, 16 bit FATs and 12 bit FATs and it is perhaps useful at this stage to consider what these mean. They all simply refer to the number of bits used in the FAT table to describe one entry. So, a 12 bit FAT (FAT12 or more often just FAT) uses 12 bits (1.5 bytes) per FAT entry, a 16 bit FAT (FAT16) uses 16 bits (2 bytes) per FAT entry and a 32 bit FAT (FAT32) uses 32 bits (4 bytes) per FAT entry. Note, however, that a FAT32 entry is actually only a 28 bit entry for the FAT itself, since the four most significant bits of each entry are reserved for other purposes. The possible values that may be given to each entry in the FAT are listed at Table 5.19. In addition to what has been described before, we see that FF7h (and FFF7h and 0FFFFFF7h) are used to mark a cluster as bad, FF8h to FFEh (and FFF8h to FFFEh and 0FFFFFF8h to 0FFFFFFEh) are reserved and FFFh (and FFFFh and 0FFFFFFFh) are the markers for the last cluster in a file92. In passing, we may note that clusters marked in the FAT as bad are another possible place where infor- mation could be hidden.
There has been some lack of clarity in the past over precisely what FAT system type should be used for any particular disk size and it is likely that a number of disks with incompatible FAT systems exist as a result. Microsoft have produced a definitive document for their operating systems (Microsoft, 2000), and within it is the following statement: “This is the one and only way that FAT type is determined. There is no such thing as a FAT12 volume that has more than 4084 clusters. There is no such thing as a FAT16 volume that has less than 4085 clusters or more than 65,524 clusters. There is no such thing as a FAT32 volume that has less than 65,525 clusters. If you try
92 Note, however, that there are various disk utilities for Microsoft operating systems that use a different value for the last cluster in a file marker; see Microsoft (2000).
to make a FAT volume that violates this rule, Microsoft operating systems will not handle them correctly because they will think the volume has a different type of FAT than what you think it does”.
The original MS-DOS FAT used 12 bits per entry and the consequence of this is that only 212(that is, 4096) allocation units or clusters can be addressed. In fact the number is less than this since 000h and 001h are not used and FF6h to FFFh are reserved or used for other purposes leaving 002h to FF5h (2 to 4085) as the range of possible clusters. If we are to use one sector per cluster, as we have assumed above, the maximum number of sectors that we can address is 4084 (the maximum number of clusters for FAT12 according to the Microsoft statement above) and at 512 bytes per sector this gives us 4084 × 512 = 2,091,008 bytes, which is slightly less than 2 Mbyte. This would mean that the largest disk that we can deal with is only 2 Mbyte in size. This is quite satisfactory for conventional floppy disks and is precisely what is used by MS-DOS for the standard floppy disk. For larger disks, however, we need to use more than one sector per cluster.
For disks up to 16 Mbyte, Microsoft systems used to use eight sectors per cluster with a 12 bit FAT (making the cluster size 8 × 512 = 4 kbyte) and this gives us a maximum size of 4084 (the maximum number of clusters for FAT12 according to the Microsoft statement above) × 4096 (the cluster size in bytes) = 16,728,064 bytes, which is just under 16 Mbyte. However, the following statement has been included in the Microsoft (2000) document: “If your media is larger than 4 MB, do not bother with FAT12. Use smaller BPB_SecPerClus93values so that the volume will be FAT16”. For example, if we had an 8 Mbyte disk (8,388,608 bytes) and specified 2 sectors per cluster (1,024 bytes), it would require 8,388,608/1,024 = 8,192 allocation units. This exceeds the 4084 maximum for FAT12 and would therefore force the format to be FAT16.
For disks between 16 Mbyte and 2 Gbyte, Microsoft systems use a series of powers of 2 sectors per cluster (see Table 5.20) up to a maximum of 64 sectors per cluster (making the cluster size 64 × 512 = 32 kbyte). This gives us a maximum size of 65,524 (the maximum number of clusters for FAT16 according to the Microsoft statement above) × 32,768 (the cluster size in bytes) = 2,147,090,432 bytes, which is just under 2 Gbyte.
FAT12 FAT16 FAT32 Meaning
000h 0000h 00000000h Available for allocation 001h 0001h 00000001h Never used
002h 0002h 00000002h Next cluster in file ... ... ... Next cluster in file FF5h FFF5h 0FFFFFF5h Next cluster in file FF7h FFF7h 0FFFFFF7h Bad cluster FFFh FFFFh 0FFFFFFFh Last cluster in file Table 5.19 FAT cluster values.
The significance of the cluster size is, of course, that this is the smallest unit of disk memory that can be allocated at a time. Even if we have a file of only one or two bytes, we are forced to allocate a minimum of 32 kbyte to that file if the disk is larger than 1024 Mbyte and we are using FAT16. Prior to the introduction of FAT32 there were, therefore, real advantages in partitioning a large disk into a number of smaller logical partitions in order to reduce the cluster size in each of the partitions and hence the amount of wasted space. This wasted space between the end of the file and the rest of the cluster is known asslack space. The cluster size and the FAT type are decided by theFORMATprogram when high-level formatting is carried out on the partition and the rules applied are those that are given in the Microsoft (2000) document.
You may have noted that the largest sectors per cluster value in Table 5.20 is 64, resulting in a cluster size in bytes of 32,768. The reason for this limit, apart from not increasing further the amount of wasted space, is understood to be that some 16 bit programs make the assumption that the cluster size in bytes (which must be a power of two) will always fit into a 16 bit word. The value 32,768 (or 64 sectors per cluster) does fit, but the next power of two, 65,536 (or 128 sectors per cluster) does not, since the range in 16 bits is 0 to 65,535. The consequence of this is that no normal FAT16 partition may exceed 32,768 (the maximum cluster size in bytes that will fit into a 16 bit word) times 65,524 (the maximum number of clusters for FAT16 as given in the Microsoft (2000) document) which, as stated above, is just under 2 Gbyte. This is where the 2 Gbyte maximum partition limit comes from. Although it is possible, using Windows NT utilities, to produce FAT16 partitions which have 128 sectors per cluster (64 kbytes) and are 4 Gbyte in size, such partitions are not recommended by Microsoft (see Microsoft, 1999a) for use with MS-DOS or Windows 9x.
Returning for a moment to Fig. 5.33, we can now also see why the files area does not extend to the very end of the partition. The total number of sectors available for the files area in Fig. 5.33 is 1,032,128 – 536 = 1,031,592. Dividing this by the cluster size, 16, we obtain 64,474 clusters, with a remainder of 8 sectors. This means that the last 8 sectors in the partition cannot be addressed by the file system, which extends only to LSN 64,474 × 16 + 536 = 1,032,120. This lost area, in this case of 8 sectors, is called “Volume Slack” by some authorities and is yet another good place to hide information.
Logical drive size FAT type Sectors per cluster Cluster size
0–4 Mbyte 12 bit 8 4 kbyte
4.1–15 Mbyte 16 bit 2 1 kbyte
16–127 Mbyte 16 bit 4 2 kbyte
128–255 Mbyte 16 bit 8 4 kbyte
256–511 Mbyte 16 bit 16 8 kbyte
512–1023 Mbyte* 16 bit 32 16 kbyte
1024–2047 Mbyte* 16 bit 64 32 kbyte Table 5.20 Microsoft hard disk cluster sizes up to 2 Gbyte.