FAT Recovery with Recover My Files
The FAT (File Allocation Table) file system was first developed in the mid 1970’s. Microsoft's FAT32, released with Windows 95, remains the standard format for removable storage media today. This is primarily due it its cross platform compatibility between Windows and Macintosh computers and is why external USB storage devices vendors use it as their default file system.
The most recent update to FAT was in 2006 when Microsoft released "exFAT". This was done to improve the performance of the file system on large hard drives and to break the FAT32 maximum file size limit of 4GB.
The basic structure of a FAT files system is shown below:
When a disk is formatted with the FAT file system, a Volume Boot Record (VBR) is created. The VBR's code is executed directly when the disk is booted and it is responsible for providing information to the operating system about the location of the other structures, including the FAT, Root directory and data area.
FAT Directory Entries
Every file on a FAT hard disk is stored in a directory (a directory itself is considered by FAT to be a special type of file). The top level directory is referred to as the “Root”. On a FAT file system the Root directory is given special status and is usually positioned on the disk directly after the FAT. Other directories can be located anywhere in the data area of the disk.
All FAT directories, including the Root, are made up of directory entries. Directory entries are the means by which a FAT file system stores file and folder names and manages the hierarchical directory structure. When a file is created on a FAT file system a directory entry is created for it. A directory entry is:
- A twelve, sixteen or thirty two byte data structure (depending on FAT 12/16 or 32 format);
- Stored in the cluster (or clusters) allocated to the files parent directory;
- Contains the attributes of the file it represents, including:
* File name;
* Created, access and written times and dates;
* File size;
* Starting cluster;
* Allocation status (whether active or deleted);
* File status (whether it is a file or a folder).
Deleted Files
The allocation status of a file in a FAT file system is determined by the first byte of its directory entry. For an active file, the first byte is the first character of the file name. When a file is deleted the first byte is replaced with the deleted file marker, 0xE5.
File Allocation Table
File Allocation Table is the mechanism by which the FAT file system tracks the location of individual storage clusters for each file on a disk. It is a map of all clusters on the volume identifying those that are allocated for file storage and those that are not (unallocated clusters). There are two FAT tables located in the area of the disk immediately following the VBR. The second FAT table is intended as a backup of the first should it become damaged or corrupt.
The starting cluster of a file is identified to the FAT by its directory entry. Files that fit into just one cluster will have 0xFFFFFFFF in their FAT entry to indicate that there is no cluster chain to follow. If the file is larger than one cluster, the first FAT entry for that cluster points to the next FAT entry where the second cluster of the file is stored, and so on until the end of file 0xFFFFFFFF marker is reached. This is how the FAT file system tracks the location of the entire file on the disk, even if it is stored in non-contiguous clusters, i.e. a “fragmented file”. When a file is deleted, the clusters allocated to the file are set to unallocated by changing the corresponding FAT entries to 0xFFFFFFFF.
To learn how to recover a FAT hard drive, click here and follow the Drive Recovery instructions.
