This information comes from the PCGuide
and/usr/include/linux/msdos_fs.h
The first block in each partition of a hard drive is called the Volume Boot Sector. It contains information such as how big the partition is, its label name, and so forth. For FAT, the boot sector looks like this:
struct fat_boot_sector {
__s8 ignored[3]; /* Boot strap short or near jump */
__s8 system_id[8]; /* Name - can be used to special case
partition manager volumes */
__u8 sector_size[2]; /* bytes per logical sector */
__u8 cluster_size; /* sectors/cluster */
__u16 reserved; /* reserved sectors */
__u8 fats; /* number of FATs */
__u8 dir_entries[2]; /* root directory entries */
__u8 sectors[2]; /* number of sectors */
__u8 media; /* media code (unused) */
__u16 fat_length; /* sectors/FAT */
__u16 secs_track; /* sectors per track */
__u16 heads; /* number of heads */
__u32 hidden; /* hidden sectors (unused) */
__u32 total_sect; /* number of sectors (if sectors == 0) */
/* The following fields are only used by FAT32 */
__u32 fat32_length; /* sectors/FAT */
__u16 flags; /* bit 8: fat mirroring, low 4: active fat */
__u8 version[2]; /* major, minor filesystem version */
__u32 root_cluster; /* first cluster in root directory */
__u16 info_sector; /* filesystem info sector */
__u16 backup_boot; /* backup boot sector */
__u16 reserved2[6]; /* Unused */
};
The VBS also contains the code that bootstraps the operating system.
Immediately following the VBS is the File Allocation Table, or FAT
from which this file system gets its name. The partition is divided
into clusters, ranging in size from 2K to 32K (this is a constant for
an entire partition, and is specified by the cluster_size
entry in the boot sector). Disk space is
allocated on a cluster basis; there is one entry in the FAT for each
cluster. The entry contains a code telling the cluster's status: 0
means the cluster is unallocated, there is another code for a bad
cluster, and so forth. Files appear in the FAT as linked lists of
clusters: each entry contains the index of the next cluster in the
file. There are actually two identical copies of the FAT; the idea is
that the second one serves as a backup for the first in the event of
damage. Unfortunately, it's highly likely that since the two FATs are
right next to each other, anything that corrupts one will corrupt the
other as well.
A FAT entry is just a number: 0 for unallocated, anything up to but not including FF0 (in original FAT12) for a cluster number, FF0 through FF6 are reserved, FF7 means it's a bad cluster, and anything from FF8-FFF says it's the last cluster in the file.
After the FATs comes the root directory. Each directory entry is 32 bytes long, and contains the information for one file (or subdirectory). This looks like this:
struct msdos_dir_entry {
__s8 name[8],ext[3]; /* name and extension */
__u8 attr; /* attribute bits */
__u8 lcase; /* Case for base and extension */
__u8 ctime_ms; /* Creation time, milliseconds */
__u16 ctime; /* Creation time */
__u16 cdate; /* Creation date */
__u16 adate; /* Last access date */
__u16 starthi; /* High 16 bits of cluster in FAT32 */
__u16 time,date,start;/* time, date and first cluster */
__u32 size; /* file size (in bytes) */
};
(note: VFAT long file names result in lots of other weird stuff
going on)
A file is marked as deleted by replacing the first character of the
file name with a 0xe5.
The number of entries in the root directory is determined by the file system media, and ranges from 112 for a 360KB floppy to 512 for a hard disk (note: this is not true of FAT32)
In thinking about this file system, consider two things: what's involved in finding a free cluster? And what happens if you want to do an lseek?