Question

I have some FAT32 structure output:

bytes_per_sector        0x200
sectors_per_cluster     0x8
reserved_sector_count   0x780
FATtable_count          0x2
root_entry_count        0
hidden_sector_count     0x38
total_sectors_32        0xf17fc8
FATtable_size_32        0x3c40
root_cluster            0x2
fat_info                0x1
backup_BS_sector        0x6

Ok, assume to this information, I jump over reserved_sector_count and get the FAT32 table. #1920 - is offset from te begining - 0x780.

fat32Table #1920 
        cluster0     ffffff8
        cluster1     ffffffff
        cluster2     fffffff
        cluster3     fffffff

Ok, assume to FATtable_size_32 and FATtable_count I jump over and get to the Data Region at the position #16777216 from the begining. This is the 0 cluster, as I understand. Cluster consists of 8 sectors by 512 byte each. First Directory named "F" - is volume. Second "HELLO.TXT" is a file. DirectoryEntry size of 32 byte.

name #16777216       46 [F       ]
ext                  [   ]
attrib                8
NTreserved            0
CrtTimeTenth          0
createtime            0
createdate            0
accessdate            0
clusterhigh           0
modifiedtime          81e3
modifieddate          4ace
clusterlow            0
filesize              0

name #16777216       48 [HELLO   ]
ext                  [TXT]
attrib                20
NTreserved            18
CrtTimeTenth          5c
createtime            82ca
createdate            4ace
accessdate            4ace
clusterhigh           0
modifiedtime          82d4
modifieddate          4ace
clusterlow            3
filesize              24

Next, I want to find data according to "hello.txt" file. I see clusterlow= 0x03. When I jump to next cluster (+4096 byte) and see data of my file.

name #16781312       This is test

But I don't get how does clusterlow help me to find it? What clusters ffffff8, ffffffff, fffffff in FAT32 table? How to find source data according to all this stuff?

Answer 1

@ tilz0R，感谢您的链接，但我已经阅读了MS的文档。还有更多。

我只是在DataRegion（在保留扇区和FAT32表之后）以cluster2开始，而clusterlow = 0x03表示位于下一个cluster3中的源数据比cluster2低+4096字节。

当我在磁盘上添加一个文件并看到第一个文件位于cluster3而第二个文件位于cluster4时，会更容易理解。

How to find source data of file in FAT32 by clusters and FAT table?

1 个答案: