Revisiting Various Bytes

Revisiting Various Bytes

This is the last post (hopefully) on our walk through the boot sector. There are couple byte ranges I want to briefly discuss, so I’m grouping them all into the final post. For reference, here’s our ever-present hex editor screenshot.

fat-first-36-hex-bytes.png

Bytes 19-20 should be non-zero for FAT12/16. This will be 16-bit value representing the number of sectors in the file system. For FAT32, these will contain zero and bytes 32-35 will be non-zero.

Byte 21 is self-explanatory. 0xF8 for a hard drive and 0xF0 for removable media.

Bytes 22-23 give the 16-bit size in sectors of each file allocation table. This is used only for FAT12/16. It’ll be zero for FAT32. As I mentioned when discussing bytes 14-15, the FAT area follows the reserved area and there are typically two FATs for redundancy. Bytes 22-23 give the size of these tables.

As mentioned, bytes 32-35 should be non-zero if this is FAT32. This number will be the number of sectors in the file system. The hex editor image shows 9A 7F 3D 00, which is 00 3D 7F 9A (little endian) or 4,040,362 sectors. Remember, if these bytes are non-zero, bytes 19-20 should be zero.

And this finishes our initial walk-through. If you have questions or comments, feel free to contact me. Between the two of us, we can probably figure it out.