Call: (888) 458-3222
What is a Cluster?
Microsoft operating systems rely upon the storage of data in fixed length blocks of bytes called clusters. Clusters (also known as allocation units) are essentially groupings of sectors which are used to allocate the data storage area in operating systems, i.e., DOS, Windows, etc Clusters can be one sector in size to 128 sectors in size and cluster sizes vary depending on the size of the logical storage volume and the operating system involved.
These cluster sizes fall generally within the following ranges:
• Low density 5.25 inch floppy diskette - 2 sectors
• High density 5.25 inch floppy diskette - 2 sectors
• Low density 3.5 inch floppy diskette - 2 sectors
• High density 3.5 inch floppy diskette - 1 sector
• Zero - 15MB logical hard drive partition - 8 sectors
• 16MB -127MB logical hard drive partition - 4 sectors
• 128MB - 255MB logical hard drive partition - 8 sectors
• 256MB - 512MB logical hard drive partition - 16 sectors
• 512MB - 1024MB logical hard drive partition - 32 sectors
• 1024MB - 2048MB logical hard drive partition - 64 sectors
• 2048MB - 4095MB logical hard drive partition - 128 sectors
These are general guidelines though because cluster sizes vary between file systems. For the same disk storage space, Windows NTFS, FAT16 and FAT32 based operating systems can have wildly varying cluster sizes. In point of fact, for very small files, Windows NTFS stores the data not in a cluster, but in the Master File Table where other information about the file is stored.
The starting cluster reference number of a file is listed in the directory area of the storage device, e.g., floppy diskette or logical partition of a hard disk drive. The linking of the various potential clusters assigned to one file is done in the File Allocation Table (FAT) in DOS, Windows, Windows 95 and Windows 98 and it is the central record keeper which tracks where file data is stored.
Return to FAQ
Next Question: What is a File Allocation Table (FAT)?
Reviewed and updated: March 22, 2017
Center for Computer Forensics
21800 Melrose Ave
Southfield, MI 48075
This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.