Revisiting Bytes 14, 15, and 16

Revisiting Bytes 14, 15, and 16

Before we begin, let’s clarify some terminology. We’re dealing with FAT file systems, which are comprised of three sections:

Boot Sector / Reserved area FAT Area Data Area

As you can see, a FAT file system contains a FAT Area. This is the File Allocation Table area. For now, think of the FAT Area as a list of file names and pointers to the Data Area, and think of the Data Area as the place where a file’s content actually resides. So, we’ve got our boot sector, followed by a list of file names which point to that particular file’s content.

Now let’s look again at our disk image.

fat-first-36-hex-bytes.png

We’re interested in bytes 14-15, which contain 20 00, or 00 20 (little endian). This equates to 32. Bytes 14-15 give the size, in sectors, of the reserved area. So our reserved area is 32. The reserved area is just another phrase for our boot sector. In FAT file systems, the FAT Area immediately follow the reserved area, so we know that our FAT Area begins in sector 32.

What? How can the FAT Area start in sector 32 if our reserved area is 32 sectors? Remember, we start counting from zero, so our reserved area runs from 0 to 31. Our FAT Area begins in 32.

So, bytes 14-15 tell us how big the reserved area (boot sector) is and based on this we know where the FAT Area begins.

Byte 16, 02, gives the number of FAT entries in the FAT area. Typically, for purposes of redundancy, there are 2 File Allocation Tables in every FAT Area. If one File Allocation Table becomes corrupted, the system can refer to the second and continue on. (Microsoft says for very small file systems, this can be 1.)