File System

FAT----File Allocation Table

The FAT file system is a simple file system originally designed for small disks and simple folder structures. The FAT file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume. To protect the volume, two copies of the table are kept, in case one becomes damaged.

In addition, the file allocation tables and the root folder must be stored in a fixed location so that the files needed to start the system can be correctly located. A volume formatted with the FAT file system is allocated in clusters. The default cluster size is determined by the size of the volume. For the FAT file system, the cluster number must fit in 16 bits and must be a power of two.



Differences between FAT12, FAT16, FAT32


• FAT12 file system contains 1.5 bytes per cluster within the file allocation table.
• FAT16 file system contains 2 bytes per cluster within the file allocation table.
• FAT32 file system includes 4 bytes per cluster within the file allocation table.


System Cluster limit:

FAT12 The count of data clusters is less than 4087 clusters.
FAT16 The count of data clusters is between 4087 and 65526 clusters, inclusive.
FAT32 The count of data clusters is between 65526 and 268,435,456 clusters.



NTFS Partition Boot Sector


When you format an NTFS volume, the format program allocates the first 16 sectors for the boot sector and the bootstrap code.

On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr (NT loader program) to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location. However, if the data is corrupted, the MFT cannot be located, and Windows NT/2000 assumes that the volume has not been formatted.


The following example illustrates the boot sector of an NTFS volume formatted while running Windows 2000. The printout is formatted in three sections:

• Bytes 0x00– 0x0A are the jump instruction and the OEM ID (shown in bold print).
• Bytes 0x0B–0x53 are the BPB and the extended BPB.
• The remaining code is the bootstrap code and the end of sector marker (shown in bold print).



NTFS Master File Table (MFT)


Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector. A duplicate of the boot sector is located at the logical center of the disk.

The third record of the MFT is the log file, used for file recovery. The log file is discussed in detail later in this chapter. The seventeenth and following records of the master file table are for each file and directory (also viewed as a file by NTFS) on the volume.

This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it's there for you to use.