Revisiting Bytes 11, 12, and 13

Revisiting Bytes 11, 12, and 13

As mentioned in FAT Boot Sector Walk Through, bytes 11 and 12 give the number of bytes through sector. Looking at our disk image below, we see 00 02.

fat-first-36-hex-bytes.png

Bytes are grouped into sectors. A sector is the smallest unit of storage on a disk.1 A sector is basically a subdivision of a track on a hard drive.2 All you need to know is that a sector is a collection of bytes.

You will typically only see sector sizes of 512, 1024, 2048 or 4096. 512 is by far the most common. Remembering that we’re using little endian, 00 02 is actually 02 00, or 512. So our sector sizes are 512.

Byte 13 gives the number of sectors per cluster. Clusters are a collection of sectors. In the EXT2 and EXT3 file systems, these collections are called blocks. In Windows, they’re called clusters. Byte 13 tells us how many sectors are contained in each cluster, and we can see the hex value is 08, which is also decimal 8. So each cluster contains 8 sectors, which means our clusters are 4,096 bytes. This is computed as sector size (bytes 11-12, 512) x number of sectors (byte 13, 8).

Footnotes

1 Hard Disk Sector Structures

2 Disk Sector