Call:   (888) 458-3222

 

FAT (File Allocation Table)

 

Microsoft operating systems rely upon the storage of data in fixed length blocks of bytes called clusters. The size of these blocks is dependent upon the type of storage device and the size of the storage device. For Microsoft operating systems before Windows XP a File Location Table (FAT) is used to track which clusters have been allocated to a specific file. The FAT is relied upon by the operating system much like a road map to locate the data associated with a specific file. References in the FAT act as pointers and they point to clusters by numeric reference. The top four bits of the cluster number in FAT 32 are reserved and are not available for cluster enumeration. Thus, FAT 32 systems can have at most 2**28-1 or 268,435,455 clusters. The same rule of thumb applies for FAT 12 and FAT 16 systems. FAT 12 systems can have up to 4079 clusters and FAT 16 systems can have up to 65519 clusters. The four reserved bits are reserved to identify values meaning things like "empty", "bad sector" and "End of file" in the referenced cluster.

 

The FAT on a floppy diskette will typically rely upon 12-bit numbers (FAT 12). When hard disk drives are involved, Microsoft Windows and Windows 95a rely upon a 16-bit FAT. Microsoft Windows 95b and Windows 98 were designed to deal with more data and huge hard disk drives. The FAT on these newer operating systems relies upon 32-bit numbers.

 

 

 

 

 

 

 

 

Return to FAQ

Next Question: What is a File Signature?

Center for Computer Forensics

21800 Melrose Ave

Suite 1

Southfield, MI 48075

 

info@computer-forensics.net

This website is not intended to provide legal or professional advice. The site is merely a starting point to learn about the topics listed. While we attempt to maintain current, complete and accurate information we accept no responsibility for errors or omissions.