We are talking about the Fat file system here in course eight And
in module before we're going to talk about the file allocation table,
we're going to take a look at how it works and how we read it.
The facts of the file allocation table is the call.
What they do is they track cluster allocation which clusters are in use being
occupied by a file and which clusters are not in use and available to be written to?
Yeah.
File allocation table has an entry for every cluster on the volume.
Fat one and fat too should be the same because Fat too is a backup for
recovery purposes.
If that one becomes corrupted,
they are located in the system area on all versions of that.
And again, they're used to track cluster allocation status,
whether the cluster is being occupied by a file or
it's available to be written to each of these entries
which represents a cluster on the drive will give us
the location of the next cluster of that file here is
kind of a visual example of what the facts do we have?
Our system area and our fats
are in the system area now out in
the data area we have our files,
we have a file here just written.
And cluster too, cluster two Points to
cluster six where the rest of this file lives.
So this file is what we call fragmented.
Yeah.
In other words it's not right next to each other.
Part of it is in cluster too.
And then the other part of it is in cluster six.
If we look at cluster three, Cluster three points us to
cluster four and then we have an end of file marker E o f.
This would be called a contiguous file Because cluster
three is right next to cluster four.
And then looking at our diagram and cluster five, we just have an end
of file marker which this tells me that the file occupying Cluster five only
needs one cluster so it's not big enough to need more than one cluster.
A fat writes the data to the first available cluster.
So if we deleted one of these and
wrote a new file it could go into this empty space.
Now we're going to see Type three Types of entries in the fat,
you're going to see this marker, a first offense offense or
less and that indicates end of file that tells us
we're either at the end of a cluster chain or
if it's only occupies one cluster will just see that marker
in the cluster that represents that file on the draft.
You could see 000000.
And this indicates that the cluster is not being used,
it's available to be written to or
we'll see a pointer to the next cluster And down here we can see this
is what a fat table is going to look like when we view it with our tools.
This F A f f f f Os.
This is what we call a media descriptor generally indicates fixed disk but
it's what we call a media descriptor.
These next four bites Tell us the version of Fat one looking at and
since they were all maxed out at ff ff ff We know we're looking at Fat 32.
Fat 32 has four byte entries.
Fat 12 and 16 Have to bite entries for each cluster but
we are going to focus on fat 32 because that's most likely what we'll see today.
So four Byte entries.
These next four bites represent cluster two because our cluster
numbering out on our drives is going to start it too.
So this represents cluster too and it's pointing to would have
to translate that number but it's pointing to another cost around
in the drive this would be the Filed clustered 3's representation and
cluster to re has an end of file marker which means the file that
is occupying cluster three only takes up one cluster And
we had the four bytes for close to four and we have an end of file marker.
Cluster five we have an entire file marker.
Now we look at cluster six Cluster six points to cluster seven.
If we look at the four bytes that represent cluster seven in our fat table,
They pointed to cluster eight 9 10.
It just goes you can see this is a long continuous file.
Yes this is showing us what we have in our fat tables.
It's the same fat table we looked at in the previous slide we have our media
descriptor for bites, then we have our fat type.
Then this The next four bytes represents cluster too.
And cluster two points out to cluster 42656.
If we translated and these are red the Lindy in again,
If we translated 0000 86 Ao would come up with 42,665.
So that's what cluster to cluster to.
Points to that cluster.
Now if we look at cluster three, Hesitant to file marker close to 400 and
a file marker five And then cluster six Points to cluster seven.
We look at the entry for cluster seven It points to eight Mr eight points to nine.
And this file just goes on to the very end.
We have clustered 20 down here Pointing to cluster 21.
So that would be how we would look at our fat table.
We're going to do a walk through and take a look at this on disk.
So please attach your NPR Bhd note that this number of your
attached virtual hard drive so we can locate it.
And please open up active disk editor for our walk through.
The first thing we're going to do is attach R V H.
D.
So we'd go to actions, attach PhD would navigate out.
Find R M B R V H.
D.
Mhm click open and it will attach the V H.
D. For us.
Yeah.
Once we've done that, mm hmm.
We can see R V H.
D.
Remember the drive number.
Mhm.
Now we're going to open Active disk editor.
Mhm.
Once Active disk editor opens, we're going to open a logical volume,
again the same logical volume we did for our last walk through and
we're going to take a look at the fat file table and see how our tool shows it to us.
Yes.
And I'm going to show you an easier way to read it.
So we're going to select open disk.
Mhm.
We're going to select volumes because we want to look at the volume,
not a physical disk.
And we are going to select our fat 32 volume.
That is 200 MB in size.
My name is Dr S and we're going to open it.
Okay.
Yeah.
Again when it opens by default this tool will take you to the volume boot record.
Mhm.
We've already taken a look at this so
we know how many sectors we have per cluster And
just in case it's four sectors per cluster In 512 bytes per sector.
Yeah, now we're going to go up to the navigate button and
we're going to navigate to Fat one and we look at this,
it's a little hard to read But
we know each one of our entries is four bytes in length.
So what we're going to do is we're going to go to file mhm Preferences and
we're going to change our view in bytes per line from 16 to 4 and
we're going to click OK once that opens up it makes it
a little bit easier for us to read our fat table.
The first entry at our fat table is going to be the media descriptor.
Mhm.
And we have F a f f f f o f and this usually indicates a fixed disk.
Our next entry, our next four byte entry in our fat table is going to tell
us what version of fat we're looking at and we can see we have ff ff ff ff.
So we know we're looking at Fat 32.
This next entry down here represents cluster too because cluster
numbering starts at two out on the volume, so cluster too,
Cluster two in this particular fat table has an end of file marker in it.
That means that the file occupying cluster to only needs one cluster.
We looked down, we see our entry for cluster three.
This entry represents cluster three, it's telling us its allocation status,
it's telling us it is allocated and it doesn't point to another cluster.
So we know that the file and cluster three only takes up one cluster.
We look at the Representation for Cluster four.
We see the same thing,
we look at the entry for cluster five,
we see the same thing 6789 10, 11, 12.
Now, when we look at the entry for cluster 13.
Mhm And we highlight it little indian.
Yeah, We can see that the entry for
cluster 13 these four bytes represent close to 13 and
they have a pointer in them and that pointer is telling us to go to,
we look at our data interpreter, cluster 14, we look at the entry for
cluster 14 and that's pointing us to cluster 15.
Mhm.
We could see it.
Our data interpreter or zero.
f is 15.
So we look at the representation the entry in our Table for
cluster 15 And it points to cluster 16.
We look at the fat table entry for
cluster 16 right below and
it points us to cluster 17.
So we look at the entry for cluster 17 And
it points us to cluster 18.
And when we look at the four Byte fat table entry For
cluster 18 we see an end of file marker.
Mm hmm.
The company people.
Yeah, if we continue down the table.
Mhm.
We can see that.
Yeah.
Mhm.
Cluster 19 also has an end of file marker in it.
Cluster 20 has an end of file marker in it.
Yeah.
We look at the Fat Table entry for Claim 21.
We can see all zeros and we know that all zeros
means that the clusters are marked as available to be written to.
Mhm.
Know that.
To see a cluster in the middle of the table marked is available to be
written to maybe an indication that a file was deleted there.
Mhm.
If we look down in our fat table, we see more into file markers and
we see more files that are contiguous meaning that
the clusters are one right after the other.
They're not fragmented but we're not jumping from one cluster to another.
And that would be how we would take a look at our fat table.
Yeah.