Microsoft Windows and file systems. File systems

1. Sector structure FSInfo struct fat_boot_fsinfo:
   • __u32 signature1– signature 0x41615252;
   • __u32 signature2– signature 0x61417272;
   • __u32 free_clusters– number of free clusters. If the field contains -1, the search for free clusters must begin with cluster number 2.
2. Short name directory element structure struct msdos_dir_entry:
   • __s8 name,ext– file name and extension;
   • __u8 attr– file attributes;
   • __u8 ctime_ms– this field specifies the file creation time to ms (only FAT32 is used);
   • __u16 ctime– file creation time (only FAT32 is used);
   • __u16 date– file creation date (only FAT32 is used);
   • __u16 date– date of last access to the file (only FAT32 is used);
   • __u16 starthi– the most significant 16 bits of the file’s first cluster number (only FAT32 is used);
   • __u16 time,date,start– time and date of file creation, number of the first cluster of the file;
   • __u32 size– file size (in bytes).
3. Long name directory element structure:
   • __u8 id– element number;
   • __u8 name0_4– characters 1 – 5 of the name;
   • __u8 attr– file attributes;
   • __u8 alias_checksum– short name checksum;
   • __u8 name5_10– symbols 6 – 11 of the name;
   • __u8 name11_12– symbols 12 – 13 of the name.

Let's continue to consider the software implementation of the algorithm and determine the name of the partition on which the FAT16 file system was created:

#ifndef FAT16_PART_NAME

#define FAT16_PART_NAME "/dev/hda1"

#endif

Global structures:

struct fat_boot_sector fbs; // boot sector structure

struct msdos_dir_entry dentry; // directory element structure

Global variables:

U16 *fat16; // copy the FAT16 table here

U16 sector_size; // sector size (from FAT16)

U16 dir_entries; // number of 32-byte descriptors

// in the root directory (0 for FAT32)

U16 sectors; // total number of sectors in the partition

U32 fat16_size; // FAT16 size

U32 root_size; // root directory size

U16 byte_per_cluster; // cluster size in bytes

U16 next_cluster; // next cluster in the chain

int fat;

Let's start with the main function:

int main()

Int num;

We specify the full name of the file whose contents we want to read. Let me remind you that we only work with short file names. The procedure for working with long names is not discussed in this article.

U8 *full_path = "/Folder1/Folder2/text.txt";

Open the device file:

Hard = open(FAT16_PART_NAME, O_RDONLY);

If(hard< 0) {

Perror(FAT16_PART_NAME);

Exit(-1);

We read the first 10 clusters of the file. Reading is performed by the fat16_read_file() function. The function parameters are the full file name and the number of clusters to read. The function returns the number of clusters read or -1 if an error occurred while reading:

Num = fat16_read_file(full_path, 10);

If(num< 0) perror("fat16_read_file");

Else printf("Read %d clusters ", num);

Close the device file and exit:

Close(hard);

Return 0;

The function for reading file clusters has the following form:

int fat16_read_file(__u8 *full_path, int num)

Struct split_name sn; // structure for storing file components

U8 tmp_name_buff; // buffer for temporary storage of components of the full file path

Static int i = 1;

Int n;

U8 *tmp_buff;

U16 start_cluster, next_cluster;

We listed the function parameters when considering the main function.

Preparatory operations - reset the tmp_name_buff buffer and the struct split_name sn structure:

The first character in an absolute pathname of a file must be a forward slash (/). Let's check this:

Read the boot sector from the partition:

If(read_fbs()< 0) return -1;

The read boot sector is now located in the global structure struct fat_boot_sector fbs. Let's copy the sector size, the number of entries in the root directory and the total number of sectors on the partition from this structure:

Let's determine the cluster size in bytes:

Byte_per_cluster = fbs.cluster_size * 512

Let's display the information located in the boot sector:

Printf("System id - %s ", fbs.system_id);

Printf("Sector size - %d ", sector_size);

Printf("Cluster size - %d ", fbs.cluster_size);

Printf("Reserved - %d ", fbs.reserved);

Printf("FATs number - %d ",fbs.fats);

Printf("Dir entries - %d ", dir_entries);

Printf("Sectors - %d ", sectors);

Printf("Media - 0x%X ", fbs.media);

Printf("FAT16 length - %u ", fbs.fat_length);

Printf("Total sect - %u ", fbs.total_sect);

Printf("Byte per cluster - %d ", byte_per_cluster);

We calculate the size of FAT16 in bytes and read it:

Fat16_size = fbs.fat_length * 512;

If(read_fat16()< 0) return -1;

Reading the root directory:

If(read_root_dentry()< 0) return -1;

The dir_entry pointer is now positioned at the memory location containing the root directory entries. The size of this memory area is equal to the size of the root directory (root_size).

Let's save (for control) the contents of the root directory in a separate file:

#ifdef DEBUG

Close(fat);

#endif

We calculate the beginning of the data area:

Data_start = 512 * fbs.reserved + fat16_size * fbs.fats + root_size;

Having all the entries in the root directory, we can get to the contents of the test.txt file. For this purpose, we organize a cycle. In the body of the loop, we will parse the full file name, highlighting its elements - subdirectories (we have two of them, Folder1 and Folder2) and the name of the file we are looking for (test.txt).

While(1) (

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

For(n = 0 ; n< SHORT_NAME; n++, i++) {

If((tmp_name_buff[n] == "/") || (tmp_name_buff[n] == "?")) (

I++;

Break;

Tmp_name_buff[n] = "?";

We fill the struct split_name sn structure with the appropriate information. The split_name function performs the filling and checks the file name for compliance with the “8.3” format:

< 0) {

Printf("not valid name ");

Return -1;

For each element of the full file name, we define an initial cluster. To do this, we look in the directory elements (starting from the root) for an entry corresponding to the full name element, and read this entry. The search procedure is performed by the get_dentry() function:

If(get_dentry(&sn)< 0) {

Printf("No such file!");

Return -1;

Checking the file attributes. If this is a directory, read its contents and continue the loop:

If(dentry.attr & 0x10) (

If(read_directory(dentry.start)< 0) return -1;

Continue;

If this is a file, we read the first num clusters. For control, we will save the read information in a separate file:

If(dentry.attr & 0x20) (

Start_cluster = dentry.start;

Tmp_buff = (__u8 *)malloc(byte_per_cluster); // the contents of the cluster will be read here

N = open("clust", O_CREAT|O_RDWR, 0600); // save the read information in this file

If(n< 0) {

Perror("open");

Return -1;

To read file clusters, we organize a loop:

For(i = 0; i< num; i++) {

We read the contents of the cluster into the tmp_buff buffer and save it in a separate file:

< 0) return -1;

< 0) {

Perror("write");

Close(n);

Return -1;

We read from FAT16 the number of the next cluster occupied by this file. If this is the last cluster, we interrupt the loop and return to the main function:

#ifdef DEBUG

Printf("OK. Readed ");

Printf("file`s next cluster - 0x%X .. ", next_cluster);

#endif

If(next_cluster == EOF_FAT16) (

#ifdef DEBUG

Printf("last cluster.");

#endif

Free(tmp_buff);

Close(n);

Return ++i;

#ifdef DEBUG

Printf("stop reading ");

#endif

Return i;

Reading the FAT16 boot sector is performed by the read_fbs() function. The result is placed in the global fbs structure:

int read_fbs()

If(read(hard,(__u8 *)&fbs, sizeof(fbs))< 0) return -1;

Return 0;

Reading the file allocation table of the FAT16 file system is performed by the read_fat16() function:

int read_fat16()

U64 seek = (__u64)(fbs.reserved) * 512; // offset to FAT16 from the beginning of the partition

Fat16 = (void *)malloc(fat16_size);

If(pread64(hard, (__u8 *)fat16, fat16_size, seek)< 0) return -1;

Return 0;

The read_root_dentry() function reads the root directory:

int read_root_dentry()

U64 seek = (__u64)fbs.reserved * 512 + fat16_size * fbs.fats; // offset to the root directory from the beginning of the partition

Root_size = 32 * dir_entries; // calculate the size of the root directory

Dir_entry = (__u8 *)malloc(root_size);

If(!dir_entry) return -1;

Memset(dir_entry, 0, root_size);

If(pread64(hard, dir_entry, root_size, seek)< 0) return -1;

Return 0;

Reading a cluster belonging to a file is performed by the read_cluster() function. The input parameters of the function are the cluster number cluster_num and a pointer to the buffer __u8 *tmp_buff, where the reading result should be placed. The offset to the cluster on the partition is calculated using the formula (see):

SEEK = DATA_START + (CLUSTER_NUM - 2) * BYTE_PER_CLUSTER,

• SEEK– offset to the cluster on the partition
• DATA_START– start of data area
• CLUSTER_NUM– cluster serial number
• BYTE_PER_CLUSTER– cluster size in bytes

int read_cluster(__u16 cluster_num, __u8 *tmp_buff)

U64 seek = (__u64)(byte_per_cluster) * (cluster_num - 2) + data_start; // calculate the offset to the cluster

< 0) return -1;

Return 0;

The read_directory function reads entries from a directory (not the root directory) and places the result in the memory location that the dir_entry pointer is set to:

int read_directory(__u16 start_cluster)

Int i = 1;

U16 next_cluster;

For(; ;i++) (

We allocate memory to store the contents of the directory, read the contents of the starting cluster and get the value of the next cluster from the FAT16 table:

If(!dir_entry) return -1;

< 0) return -1;

Next_cluster = fat16;

Let's save the contents of the directory in a separate file (for control):

#ifdef DEBUG

Printf("Next cluster - 0x%X ", next_cluster);

Fat = open("dir16", O_CREAT|O_WRONLY, 0600);

Write(fat, dir_entry, root_size);

Close(fat);

#endif

If the last cluster is reached, we exit the loop, otherwise we continue reading the directory, increasing the size of the dir_entry buffer by one more cluster:

If(next_cluster & EOF_FAT16) break;

Start_cluster = next_cluster;

Return 0;

The get_dentry() function searches the contents of the directory for an element corresponding to the file being searched for. The input parameters of this function are a pointer to the structure struct split_name *sn containing the elements of the short file name:

Int i = 0;

The global buffer dir_entry contains an array of directory entries in which we are going to look for a file (or directory) entry. To search, we organize a cycle. In the body of the loop, we copy the directory elements into the global dentry structure and compare the values ​​of the name and ext fields of this structure with the corresponding fields of the struct split_name *sn structure. The match of these fields means that we have found an entry for the file we are looking for in the array of directory elements:

for(; ; i++) (

If(!(memcmp(dentry.name, sn->name, sn->name_len)) &&

!(memcmp(dentry.ext, sn->ext, sn->ext_len)))

Break;

If(!dentry.name) return -1;

#ifdef DEBUG

Printf("name - %s ", dentry.name);

Printf("start cluster - 0x%X ", dentry.start);

Printf("file size - %u ", dentry.size);

Printf("file attrib - 0x%X ", dentry.attr);

#endif

Return 0;

All the above code is located in the FAT16 directory, file fat16.c. To obtain an executable module, create a Makefile with the following content:

INCDIR = /usr/src/linux/include

PHONY = clean

Fat16: fat16.o split.o

Gcc -I$(INCDIR) $^ -g -o $@

%.o: %.c

Gcc -I$(INCDIR) -DDEBUG -c $^

Clean:

Rm -f *.o

Rm -f ./fat16

Software implementation of the algorithm for reading a file from a logical partition with the FAT12 file system

In general, the algorithm for reading a file from a FAT12 partition is identical to the algorithm for reading a file from a FAT16 partition. The difference lies in the procedure for reading elements from the FAT12 table. We considered the FAT16 table as a simple array of 16-bit elements. To read the elements of the FAT12 table, the following algorithm is proposed:

• multiply the element number by 1.5;
• extract a 16-bit word from FAT using the result of the previous operation as an offset;
• if the element number is even, perform the AND operation on the read word and the mask 0x0FFF. If the number is odd, shift the word read from the table by 4 bits towards the lower digits.

Based on this algorithm, we implement the function of reading elements from the FAT12 table:

int get_cluster(__u16 cluster_num)

U16 seek;

U16 clust;

We calculate the offset in the FAT12 table and read a 16-bit word from the table:

Seek = (cluster_num * 3) / 2;

Memcpy((__u8 *)&clust, (__u8 *)(fat12 + seek), 2);

If the starting number of the cluster is an even number, we shift the value read from the table by 4 bits towards the low-order bits, if it is odd, we sum it up with 0x0FFF:

If(cluster_num % 2) clust >>= 4;

Else clust &= 0x0FFF;

This fragment can also be implemented in assembler:

" xorw %%ax, %%ax "

" btw $0, %%cx "

"jnc 1f"

" shrw $4, %%dx "

"jmp 2f"

"1: andw $0x0FFF, %%dx "

"2: movw %%dx, %%ax "

:"=a" (next)

:"d" (clust), "c" (cluster_num));

We return the result:

Returnclust;

Let's take a closer look at the algorithm itself. Let's assume that a file has been created on a FAT12 partition that occupies the 9th and 10th clusters. Each FAT12 element takes up 12 bits. Because from the table we read 16-bit elements, then the offset to the 9th element will be equal to 13 bytes (9 * 1.5 = 13, the rest is discarded), while the lower 4 bits will belong to the 8th FAT element. They need to be discarded, and to do this, it is enough to shift the read element by 4 bits towards the lower digits, which is provided by the algorithm. The offset to the 10th element will be 15 bytes, and the most significant 4 bits will belong to the 11th FAT element. To discard them, it is necessary to perform an AND operation on the 10th element and the mask 0x0FFF, which also corresponds to the above algorithm.

The source texts of the module for reading a file from a FAT12 partition are located in the FAT12 directory, file fat12.c.

Software implementation of the algorithm for reading a file from a logical partition with the FAT32 file system

The algorithm for reading a file from a partition with the FAT32 file system is practically no different from the algorithm for FAT16, except that in FAT32 the root directory can be located anywhere on the partition and have an arbitrary size. Therefore, to make it more interesting, let’s complicate the task - suppose that we only know the number of the partition with the FAT32 file system. To read information from this partition, you must first determine its coordinates - the offset to the partition from the beginning of the disk. And for this you need to have an idea of ​​the logical structure of the hard drive.

Logical structure of a hard drive

Let's consider the logical structure of a hard drive that complies with the Microsoft standard - “main partition – extended partition – non-DOS partitions”.

Hard disk space can be organized into one or more partitions, and partitions can contain one or more logical drives.

The Master Boot Record (MBR) is located on the hard drive at physical address 0-0-1. The MBR structure contains the following elements:

• non-system bootstrap (NSB);
• table describing disk partitions (partition table, PT). Located in the MBR at offset 0x1BE and occupies 64 bytes;
• MBR signature. The last two bytes of the MBR must contain the number 0xAA55.

The partition table describes the placement and characteristics of the partitions available on the hard drive. Disk partitions can be of two types - primary (primary, main) and extended (extended). The maximum number of primary partitions is four. The presence of at least one primary partition on the disk is mandatory. An extended partition can be divided into a large number of subpartitions - logical drives. A simplified structure of the MBR is presented in Table 7. The partition table is located at the end of the MBR; 16 bytes are allocated to describe the partition in the table.

Table 7. MBR structure

Bias Size, bytes 0 446 0x1BE 16 0x1CE 16 0x1DE 16 0x1EE 16 0x1FE 2

The partition table entry structure is shown in Table 8.

Table 8. Partition table entry structure

The first byte in the section element is the section activity flag (0 – inactive, 0x80 – active). It is used to determine whether the partition is system boot and whether there is a need to load the operating system from it when the computer starts. Only one section can be active. The partition activity flag is followed by the coordinates of the beginning of the partition - three bytes indicating the head number, sector number and cylinder number. The cylinder and sector numbers are specified in the interrupt format Int 0x13, i.e. bits 0-5 contain the sector number, bits 6-7 – the most significant two bits of the 10-bit cylinder number, bits 8-15 – the least significant eight bits of the cylinder number. This is followed by a System ID code, indicating that this section belongs to a particular operating system. The identifier occupies one byte. Behind the system identifier are the coordinates of the end of the section - three bytes containing the numbers of the head, sector and cylinder, respectively. The next four bytes are the number of sectors before the partition, and the last four bytes are the size of the partition in sectors.

Thus, a partition table element can be described using the following structure:

struct pt_struct (

U8 bootable; // section activity flag

U8 start_part; // coordinates of the beginning of the section

U8 type_part; // system identifier

U8 end_part; // coordinates of the end of the section

U32 sect_before; // number of sectors before the partition

U32 sect_total; // partition size in sectors (number of sectors in the partition)

The primary partition element points directly to the boot sector of the logical disk (there is always only one logical disk in the primary partition), and the extended partition element points directly to a list of logical disks made up of structures called secondary MBR (Secondary MBR, SMBR).

Each disk of the extended partition has its own SMBR block. SMBR has a structure similar to MBR, but it does not have a boot record (filled with zeros), and only two of the four partition descriptor fields are used. The first element of the section points to the logical disk, the second element points to the next SMBR structure in the list. The last SMBR of the list contains a partition code of zero in its second element.

Let's return to the module for reading a file from a FAT32 partition.

Header files:

#include

#include

#include

#include

#include

MBR signature:

#define SIGNATURE 0xAA55

Device file from which partition information will be read:

#define DEVICE "/dev/hda"

Partition table element size (16 bytes):

#define PT_SIZE 0x10

The following array of structures maps a section's type code to its symbolic representation:

struct systypes (

U8 part_type;

U8 *part_name;

struct systypes i386_sys_types = (

(0x00, "Empty"),

(0x01, "FAT12"),

(0x04, "FAT16<32M"},

(0x05, "Extended"),

(0x06, "FAT16"),

(0x0b, "Win95 FAT32"),

(0x0c, "Win95 FAT32 (LBA)"),

(0x0e, "Win95 FAT16 (LBA)"),

(0x0f, "Win95 Ext"d (LBA)"),

(0x82, "Linux swap"),

(0x83, "Linux"),

(0x85, "Linux extended"),

(0x07, "HPFS/NTFS")

Let's determine the number of elements in the i386_sys_types array using the PART_NUM macro:

#define PART_NUM (sizeof(i386_sys_types) / sizeof(i386_sys_types))

Let's set a limit on the number of logical drives:

#define MAX_PART 20

The following structure array will contain information about the logical drives on the device (hard drive):

struct pt_struct (

U8 bootable;

U8 start_part;

U8 type_part;

U8 end_part;

U32 sect_before;

U32 sect_total;

) pt_t;

int hard; // device file descriptor

U8 mbr; // count MBR here

Number of the partition on which the FAT32 file system was created:

#define FAT32_PART_NUM 5

Structures of the boot sector, FSInfo sector and directory entry (defined in the file ):

struct fat_boot_sector fbs;

struct fat_boot_fsinfo fsinfo;

struct msdos_dir_entry dentry;

U32 *fat32 = NULL; // copy the FAT32 table here

U16 sector_size; // sector size (from FAT32)

U16 dir_entries; // 0 for FAT32

U16 sectors; // number of sectors on the partition

U32 fat32_size; // FAT32 size

U32 data_start; // start of the data area

U16 byte_per_cluster; // how many bytes are in the cluster (cluster size in bytes)

U32 next_cluster; // next cluster in the chain

U32 root_cluster; // ROOT cluster - initial cluster of the root directory

U8 *dir_entry = NULL; // pointer to directory entries

U64 start_seek = 0; // starting offset to the partition (in bytes)

Main function:

int main()

Int num = 0;

Int cluster_num = 5; // how many clusters to read from the file

U8 *full_path = "/Folder1/Folder2/readme"; // file to read

We open the device, get information about the partition table on the device and display information about the partitions:

Hard = open(DEV_NAME, O_RDONLY);

If(hard< 0) {

Perror(DEV_NAME);

Exit(-1);

If(get_pt_info(hard)< 0) {

Perror("get_pt_info");

Exit(-1);

Show_pt_info();

We calculate the starting offset to the partition:

Start_seek = (__u64)(pt_t.sect_before) * 512;

Read the clusters belonging to the file:

Num = fat32_read_file(full_path, cluster_num);

If(num< 0) perror("fat32_read_file");

Else printf("Read %d clusters\n", num);

Close(hard);

Return 0;

Information about the partition table is read by the get_pt_info() function:

int get_pt_info(int hard)

Int i = 0;

U64 seek;

We read the partition table from the MBR and check the signature:

Read_main_ptable(hard);

If(check_sign()< 0) {

Printf("Not valid signature!\n");

Return -1;

We are looking for the extended section identifier. If there is one, we calculate the offset to the extended partition and read information about the logical drives:

for(; i< 4; i++) {

If((pt_t[i].type_part == 0xF) || \

(pt_t[i].type_part == 0x5) || \

(pt_t[i].type_part == 0x0C)) (

Seek = (__u64)pt_t[i].sect_before * 512;

Read_ext_ptable(hard, seek);

Break;

Return 0;

Partition table reading function read_main_ptable():

void read_main_ptable(int hard)

If(read(hard, mbr, 512)< 0) {

Perror("read");

Close(hard);

Exit(-1);

Memset((void *)pt_t, 0, (PT_SIZE * 4));

Memcpy((void *)pt_t, mbr + 0x1BE, (PT_SIZE * 4));

Return;

Signature checking function check_sign():

int check_sign()

U16 sign = 0;

Memcpy((void *)&sign, (void *)(mbr + 0x1FE), 2);

#ifdef DEBUG

Printf("Signature - 0x%X\n", sign);

#endif

If(sign != SIGNATURE) return -1;

Return 0;

Extended Partition Table Read Function:

void read_ext_ptable(int hard, __u64 seek)

Int num = 4; // starting from this position, the array of pt_t structures will be filled with information about logical drives

U8 smbr;

Input data:

• hard– device file descriptor;
• seek– offset to the extended partition from the beginning of the disk (in bytes).

To obtain information about logical drives, we organize a loop:

For(;;num++) (

We read SMBR, located at the seek offset from the beginning of the disk:

Memset((void *)smbr, 0, 512);

Pread64(hard, smbr, 512, seek);

We fill two elements of the pt_t table, starting from position num. The first element will point to the logical drive, and the second will point to the following SMBR structure:

Memset((void *)&pt_t, 0, PT_SIZE * 2);

Memcpy((void *)&pt_t, smbr + 0x1BE, PT_SIZE * 2);

We make an amendment to the “Start sector number” field - counting is from the beginning of the disk:

Pt_t.sect_before += (seek / 512);

If the partition type code is zero, then there are no more logical drives:

If(!(pt_t.type_part)) break;

We calculate the offset to the following SMBR:

Seek = ((__u64)(pt_t.sect_before + pt_t.sect_total)) * 512;

Return;

The show_pt_info() function displays information about the found logical drives on the device:

void show_pt_info()

Int i = 0, n;

#ifdef DEBUG

Printf("The number of partitions on the disk is %d\n", PART_NUM);

#endif

For(; i< MAX_PART; i++) {

If(!pt_t[i].type_part) break;

Printf("\nPartition type %d - ", i);

For(n = 0; n< PART_NUM; n++) {

If(pt_t[i].type_part == i386_sys_types[n].part_type) (

Printf("%s\n", i386_sys_types[n].part_name);

Break;

If(n == PART_NUM) printf("unknown type\n");

Printf("Boot sign - 0x%X\n", pt_t[i].bootable);

Printf("Sectors in partition %d - %d\n", i, pt_t[i].sect_total);

Printf("Sectors before partition %d - %d\n\n", i, pt_t[i].sect_before);

Return;

Reading file clusters from a FAT32 partition is performed by the fat32_read_file() function. This function has a lot in common with the fat16_read_file() function, so please refer to point 6 for detailed comments:

int fat32_read_file(__u8 *full_path, int num)

Struct split_name sn;

U8 tmp_name_buff;

Int i = 1, n;

U32 start_cluster, next_cluster;

U8 *tmp_buff;

Preparatory operations - we clean the buffer, structure and check the first slash:

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

If(full_path != "/") return -1;

Reading the boot sector:

If(read_fbs()< 0) return -1;

Memcpy((void *)§or_size, (void *)fbs.sector_size, 2);

Memcpy((void *)&dir_entries, (void *)fbs.dir_entries, 2);

Memcpy((void *)§ors, (void *)fbs.sectors, 2);

We read the FSInfo structure and display the signature located in it:

If(read_fs_info()< 0) return -1;

Printf("Signature1 - 0x%X\n", fsinfo.signature1);

Printf("Signature2 - 0x%X\n", fsinfo.signature2);

Fat32_size = fbs.fat32_length * 512; // FAT32 size in bytes

Data_start = 512 * fbs.reserved + fat32_size * 2; // start of the data field

Byte_per_cluster = fbs.cluster_size * 512; // cluster size in bytes

Root_cluster = fbs.root_cluster; // cluster number of the root directory

Reading FAT32:

If(read_fat32()< 0) return -1;

Allocate memory for directory entries:

Dir_entry = (__u8 *)malloc(byte_per_cluster);

If(!dir_entry) return -1;

Reading the root directory:

If(read_directory(root_cluster)< 0) return -1;

We parse the full path of the file and divide each element into its components:

While(1) (

Memset(tmp_name_buff, 0, SHORT_NAME);

Memset((void *)&sn, 0, sizeof(struct split_name));

For(n = 0 ; n< SHORT_NAME; n++, i++) {

Tmp_name_buff[n] = full_path[i];

If((tmp_name_buff[n] == "/") || (tmp_name_buff[n] == "\0")) (

I++;

Break;

Tmp_name_buff[n] = "\0";

If(split_name(tmp_name_buff, &sn)< 0) {

Printf("not valid name\n");

Return -1;

If(get_dentry(&sn)< 0) {

Printf("No such file!\n");

Return -1;

To obtain the starting number of a cluster in the FAT32 file system, you must use the highest word of the number of the first cluster of the file - the starthi field of the dentry structure:

Start_cluster = (((__u32)dentry.starthi<< 16) | dentry.start);

Checking the attribute byte:

If(dentry.attr & 0x10) ( // this is the directory

If(read_directory(start_cluster)< 0) return -1;

Continue;

If(dentry.attr & 0x20) ( // and this is a file

Tmp_buff = (__u8 *)malloc(byte_per_cluster);

N = open("clust", O_CREAT|O_RDWR, 0600);

If(n< 0) {

Perror("open");

Return -1;

Printf("file`s first cluster - 0x%X .. ", start_cluster);

For(i = 0; i< num; i++) {

Memset(tmp_buff, 0, byte_per_cluster);

If(read_cluster(start_cluster, tmp_buff)< 0) return -1;

If(write(n, tmp_buff, byte_per_cluster)< 0) {

Perror("write");

Return -1;

If(next_cluster == EOF_FAT32) (

Free(tmp_buff);

Close(n);

Return ++i;

Start_cluster = next_cluster;

Return i;

The purpose of the next three functions is to obtain the contents of the system area, i.e. boot sector, FSInfo structure and FAT32 table:

1) the read_fbs() function reads the boot sector:

int read_fbs()

If(pread64(hard, (__u8 *)&fbs, sizeof(fbs), start_seek)< 0) return -1;

Return 0;

2) the read_fs_info() function reads the FSInfo structure:

int read_fs_info()

U64 seek = (__u64)fbs.info_sector * 512 + start_seek;

If(pread64(hard, (__u8 *)&fsinfo, sizeof(fsinfo), seek)< 0) return -1;

Return 0;

3) the read_fat32() function reads the FAT32 table:

int read_fat32()

U64 seek = (__u64)fbs.reserved * 512 + start_seek;

Fat32 = (void *)malloc(fat32_size);

If(!fat32) return -1;

If(pread64(hard, (__u8 *)fat32, fat32_size, seek)< 0) return -1;

Return 0;

The read_cluster() function reads the cluster with the specified number:

int read_cluster(__u32 cluster_num, __u8 *tmp_buff)

U64 seek = (__u64)(byte_per_cluster) * (cluster_num - 2) + data_start + start_seek;

If(pread64(hard, tmp_buff, byte_per_cluster, seek)< 0) return -1;

Return 0;

The read_directory() function is used to read directories (including the root directory):

int read_directory(__u32 start_cluster)

Int i = 2;

U32 next_cluster;

The function parameters are the starting cluster of the directory. We read the contents of the directory into the global buffer dir_entry:

If(read_cluster(start_cluster, dir_entry)< 0) return -1;

Next_cluster = fat32;

If the directory occupies one cluster, exit; if not, increase the memory size and continue reading:

For(; ;i++) (

Start_cluster = next_cluster;

Dir_entry = (__u8 *)realloc(dir_entry, i * byte_per_cluster);

If(!dir_entry) return -1;

If(read_cluster(start_cluster, (dir_entry + (i - 1) * byte_per_cluster))< 0) return -1;

Next_cluster = fat32;

If((next_cluster == EOF_FAT32) || (next_cluster == 0xFFFFFF8)) return 0;

Return 0;

The last function we'll look at searches the contents of a directory for an element that matches the file we're looking for:

int get_dentry(struct split_name *sn)

Int i = 0;

The dir_entry pointer is set to an area of ​​memory containing an array of directory entries in which we are going to search for the file (or directory). To search, we organize a cycle and place the found record in the global dentry structure:

For(;;i++) (

Memcpy((void *)&dentry, dir_entry + i * sizeof(dentry), sizeof(dentry));

If(!(memcmp(dentry.name, sn->name, sn->name_len)) &&

!(memcmp(dentry.ext, sn->ext, sn->ext_len)))

Break;

If(!dentry.name) return -1;

Return 0;

This concludes our review of the module for reading a file from a FAT32 partition.

The source code for the module is located in the FAT32 directory, file fat32.c.

Differences in the organization of storing file records in directories for the FAT and EXT2 file systems

A few words about the differences in organizing the storage of file records in directories for the FAT and EXT2 file systems. The structure of the EXT2 file system was discussed in .

We just got acquainted with FAT - in it, all directory elements have a fixed value. When a file is created, the file system driver looks for the first unoccupied position and fills it with information about the file. If the length of the directory does not fit in one cluster, then another cluster is allocated for it, etc.

Let's look at how things are in EXT2.

Let's say we have a partition with the EXT2 file system, the block size is 4096 bytes. In this section we create a directory. The directory size will be equal to the block size - 4096 bytes. In a directory, the operating system immediately creates two entries - an entry for the current directory and an entry for the parent directory. The current directory's entry will take 12 bytes, while the parent's entry will be 4084 bytes long. Let's create a file in this directory. After this, there will be three entries in the directory - an entry of the current directory with a length of 12 bytes, an entry of the parent directory with a length of 12 bytes, and an entry of the created file with a length of, as you probably guessed, 4072 bytes. If we delete the created file, the length of the parent directory entry increases again to 4084 bytes.

Thus, when creating a file, the EXT2 file system driver looks for the maximum length entry in the directory and splits it, making room for a new entry. Well, if there is still not enough space, another block is allocated for the directory, and the length of the directory becomes 8192 bytes.

And in conclusion, a small edit to the article “Architecture of the EXT2 file system”.

This change concerns the get_i_num() function for determining the inode number by file name. The old version of this function looked like this:

int get_i_num(char *name)

Int i = 0, rec_len = 0;

Struct ext2_dir_entry_2 dent;

For(; i< 700; i++) {

If(!memcmp(dent.name, name, dent.name_len)) break;

Rec_len += dent.rec_len;

Return dent.inode;

Corrected version:

int get_i_num(char *name)

* The function parameter is the file name. The return value is the inode number of the file.

Int rec_len = 0;

Struct ext2_dir_entry_2 dent; // this structure describes the format of the root directory entry:

* The global buffer buff contains an array of directory entries. To determine the serial number of the inode file, you need to find

* in this array there is an entry with the name of this file. To do this, we organize a loop:

For(;;) (

/* Copy directory entries to the dent structure: */

Memcpy((void *)&dent, (buff + rec_len), sizeof(dent));

* A filename length of zero means we have iterated over all directory entries

* and no entries with our file name were found. So it's time to go back:

If(!dent.name_len) return -1;

/* The search is performed by comparing file names. If the names match, we exit the loop: */

If(!memcmp(dent.name, name, strlen(name))) break;

/* If the names do not match, move to the next entry: */

Rec_len += dent.rec_len;

/* If successful, return the inode number of the file: */

Return dent.inode;

Literature:

1. V. Kulakov. Programming at the hardware level: a special reference book. 2nd ed. / – St. Petersburg: Peter, 2003 – 848 p.
2. A.V.Gordeev, A.Yu.Molchanov. System software / – St. Petersburg: Peter – 2002
3. Meshkov V. Architecture of the ext2 file system. – Magazine “System Administrator”, No. 11(12), November 2003 – 26-32 p.

In contact with

You must have heard many times about file systems such as FAT32, NTFS and exFAT. But what is the difference between them? Each type has its own set of pros and cons. This is why there is no single option. In this article we will look at the main differences between the three file systems.

Speaking about the Windows operating system, we know for sure that it is installed only on a logical partition in NTFS format. Removable drives and other USB-based storage devices use the FAT32 type.

One of the formats that can be used to format Flash drives is exFAT, the successor to the old FAT32 file system.

Thus, we have three main data storage formats, widely used both for Windows and for various types of storage media.

What is a file system

A file system is a set of rules that determine how documents stored on a device are stored and retrieved. This could be a hard drive, Flash drive or SD card.

For a better understanding, let’s take the office of an ordinary company as an example. Fragments of installed documents are stored in a certain place, for example, in a desk drawer. And when it needs to open them, the file system accesses the files in an attempt to read information.

Let's assume for a second that such a system is out of order and we will immediately receive a huge amount of unidentified data, which there will be no way to study.

There are actually a large number of file systems, such as Flash File System, Tape File System and Disk File System, however, we will only focus on the main ones - FAT32, NTFS And exFAT.

What is FAT32

The FAT32 file system is the oldest and most experienced in the history of computer technology. Its journey began with the original 8-bit FAT system in 1977, which operated inside a standalone disk Microsoft Standalone Disk Basic-80. It was launched specifically for Intel 8080 NCR 7200 in 1977/1978, operating as an 8-inch floppy data input terminal.

After discussions about introducing the system with Microsoft founder Bill Gates, the code was written by the company's first employee, Mark McDonald.

The main task of the FAT file system was to work with data in the Microsoft 8080/Z80 operating system based on the MDOS/MIDAS platform, written by Mark MacDonald.

Subsequently, FAT underwent some changes, gradually moving from its original form to FAT12, FAT16 and, finally, FAT32, the name of which is now closely associated with external drives.

The main difference between FAT32 and its predecessors is to overcome the limited amount of information available for storage. 32-bit The system was released in August 1995 along with the release of Windows 95 and in its updated version made it possible to increase the upper limits of file size and data storage to 4 GB and 16 TB.

Thus, FAT32 is not intended for storing large amounts of data and installing heavy applications. This is the reason why hard drives use a file system. NTFS, which allows users to stop thinking about the amount of information they download.

To summarize, the FAT32 system is ideal for storing data, the volume of which does not exceed 4 GB, on any removable media. Its popularity is not limited only to the computer field. It is used in game consoles, HDTVs, DVD players, Blu-Ray players and any other device with a USB port. FAT32 is supported by all versions of Windows, Linux and MacOS.

What is NTFS

In 1993, Microsoft introduced a new file system NTFS(New Technology File System) in parallel with the advent of the Windows NT 3.1 operating system.

The main feature of the NTFS system is the absence of any restrictions on the size of downloaded files. Even if we tried to exceed this limit, we would fail - it is so large.

Development began in the mid-1980s during a period of collaboration between Microsoft and IBM, the goal of which was to create a new operating system that would surpass the previous ones in graphics performance.

However, the union of the two companies did not last long and, without completing the common project, they decided to stop cooperation. Subsequently, Microsoft and IBM concentrated on producing their own file systems.

For computer technology, 1989 saw the creation of HPFS from IBM, which was used for the OS/2 operating system. A few years later, in 1993, Microsoft launched NTFS v1.0, which became the official file system for Windows NT 3.1.

The theoretical size of an NTFS file is 16 EB - 1 KB, which is 18,446,744,073,709,550,502 bytes. The development team included Tom Miller, Harry Kimura, Brian Andrew, David Goebel.

The next version of the file system was NTFS v3.1, launched specifically for Microsoft Windows XP. Subsequently, it did not undergo any special changes, although many different additions were made to it. For example, it became possible to compress logical partitions, restore and NTFS symbolic links. In addition, the initial file system capacity was only 256 MB out of a whopping 16 EB - 1 KB in the new versions launched with the release of Windows 8.

Speaking of useful features introduced in NTFS v3.1, we can note the expansion of supported file formats, disk usage quotas, file encryption and the creation of reparse points. Notable is the fact that new versions of NTFS are fully compatible with previous ones.

The NTFS file system has an important feature when it comes to its recovery due to any damage. It contains a specific data structure that monitors any changes in the system and with the help of which you can always restore NTFS functionality.

This file system is supported by all versions of Windows, starting with Windows XP. Unfortunately, MacOS doesn't share Microsoft's commitment to compatibility. Apple left the option for users to read data from NTFS drives, but they will not be able to write to them. Linux support for this file system is limited to only a few versions.

What is exFAT

ExFAT(Extended FAT) is a new, extended file system from Microsoft that successfully replaces its predecessor on the field when it comes to large amounts of information.

As you probably know, most modern digital cameras use the exFAT system, since it is much lighter than NTFS, but, at the same time, allows you to save files larger than 4 GB, unlike FAT32.

Thus, when copying a 6 GB document to a Flash drive with the exFAT file system, you will not encounter the negative consequences that can be observed when using the previous version of the system.

The exFAT format is becoming increasingly popular and is used primarily with high-capacity SDXC memory cards. The main reason for this is the small size of the file system and, as previously described, the ability to save documents larger than 4 GB.

An interesting fact is that Microsoft holds US Patent 8321439, which allows you to quickly find a file using a hash of the name. Thanks to this function, any document can be found many times faster.

It is worth noting that all available add-ons for the exFAT file system have not been released to the public. To purchase them, suppliers are required to purchase a limited license from Microsoft.

This action was taken to prevent vendors from trying to monetize a Microsoft product by marking themselves as part of the company, since they would have the source code for the file system.

Since Microsoft is stubborn in its stubbornness, many users have started creating their own modifications of exFAT, one of which was exfat-fuse. It provides read and write operations for Linux distributions, including FreeBSD.

Created in 2006, the exFAT file system, which has a general limit on the amount of information as NTFS, is lighter because it does not contain all kinds of additions, like the second.

ExFAT supports read, write and is compatible with Mac, Android and Windows operating systems. For Linux you will need supporting software.

Comparison of file systems

FAT32:

• Compatibility: Windows, MacOS, Linux, game consoles and devices with a USB port.
• Pros: Cross-platform compatibility, lightweight file system.
• Minuses: restrictions on file sizes (documents up to 4 GB are available) and partition sizes up to 16 TB.
• Purpose: removable drives. Used to format Flash drives, but exFAT is preferred.

NTFS:

• Compatibility: Windows, MacOS (read-only), Linux (read-only on some distributions), Xbox One.
• Pros: no restrictions on the size of files and partitions.
• Minuses: limited cross-platform compatibility.
• Purpose: well suited for internal hard drives because it allows you to store large amounts of information that other file systems cannot handle.

exFAT:

• Compatibility: Windows XP and later, MacOS 10.6.5 and later, Linux (using FUSE), Android.
• Pros: shares the positive effects of FAT32 and NTFS, which include the ability to store files larger than 4 GB.
• Minuses: Microsoft restricts the use of the license.
• Purpose: allows you to eliminate file size restrictions for removable drives. Much preferable to its predecessor FAT32.

If you need to recover a logical partition with an unknown, damaged or deleted file system, Starus Recovery tools will help you.

Tool Starus Partition Recovery, or its analogues, Starus FAT Recovery, Starus NTFS Recovery, are designed to work with certain file systems - FAT and NTFS. The main software is able to interact with both. You can download and try programs for restoring FAT32 and NTFS file systems completely free of charge!

This article is dedicated to file systems . When installing the OS, Windows prompts you to select a file system on the partition where it will be installed, and PC users must choose from two options FAT or NTFS.

In most cases, users are content to know that NTFS is "better", and choose this option.

However, sometimes they wonder and what exactly is better?

In this article I will try to explain what is a file system, what they are, how they differ, and which one should be used.

The article simplifies some technical features of file systems for a more understandable perception of the material.

File system is a way of organizing data on storage media. The file system determines where and how files will be written on the storage media and gives the operating system access to those files.

Modern file systems have additional requirements: the ability to encrypt files, access control for files, and additional attributes. Typically the file system is written at the beginning of the hard drive. ().

From an OS point of view, a hard drive is a collection of clusters.

Cluster is a disk area of ​​a certain size for storing data. The minimum cluster size is 512 bytes. Since the binary number system is used, the cluster sizes are multiples of powers of two.

The user can figuratively imagine the hard drive as a checkered notepad. One cell on the page is one cluster. The file system is the contents of the notepad, and the file is the word.

For hard drives in PCs, there are currently two most common file systems: FAT or NTFS. Appeared first FAT (FAT16), then FAT32, and then NTFS.

FAT(FAT16) – is an abbreviation for File Allocation Table(in translation File Allocation Table).

The FAT framework was developed by Bill Gates and Mark McDonald in 1977. Used as the main file system in the DOS and Microsoft Windows operating systems (before Windows ME).

There are four versions of FAT - FAT12, FAT16, FAT32 And exFAT. They differ in the number of bits allocated to store the cluster number.

FAT12 mainly used for floppy disks, FAT16- for small disks, and the new one exFAT mainly for flash drives. The maximum cluster size supported in FAT is 64Kb. ()

FAT16 first introduced in November 1987. Index 16 in the name indicates that 16 bits are used for the cluster number. As a result, the maximum disk partition (volume) size that this system can support is 4GB.

Later, with the development of technology and the advent of disks with a capacity of more than 4 GB, a file system appeared FAT32. It uses 32-bit cluster addressing and was introduced with Windows 95 OSR2 in August 1996. FAT32 limited volume size to 128GB. This system can also support long file names. ().

NTFS(abbreviation NewTechnologyFileSystem - New Technology File System) is a standard file system for the Microsoft Windows NT family of operating systems.

Introduced on July 27, 1993 along with Windows NT 3.1. NTFS is based on the HPFS file system (an abbreviation HighPerformanceFileSystem - High Performance File System), created by Microsoft together with IBM for the OS/2 operating system.

Main features of NTFS: built-in capabilities to limit access to data for different users and user groups, as well as assign quotas (restrictions on the maximum amount of disk space occupied by certain users), use of a journaling system to increase the reliability of the file system.

File system specifications are proprietary. Typically the cluster size is 4Kb. In practice, it is not recommended to create volumes larger than 2TB. Hard drives have only just reached this size, perhaps a new file system awaits us in the future. ().

During installation of Windows XP, you are prompted to format the disk in the system. FAT or NTFS. This means FAT32.

All file systems are built on the principle: one cluster - one file. Those. one cluster stores data from only one file.

The main difference between these systems for the average user is the cluster size. “A long time ago, when disks were small and files were very small,” this was very noticeable.

Let's look at the example of one volume on a disk with a capacity of 120GB and a file of 10KB in size.

For FAT32 the cluster size will be 32Kb, and for NTFS - 4Kb.

IN FAT32 such a file will occupy 1 cluster, leaving 32-10=22Kb of unallocated space.

IN NTFS such a file will occupy 3 clusters, leaving 12-10 = 2Kb of unallocated space.

By analogy with a notepad, a cluster is a cell. And having placed a dot in a cell, we already logically occupy it all, but in reality there is a lot of free space left.

Thus, the transition from FAT32 To NTFS allows you to use your hard drive more optimally when there are a large number of small files on the system.

In 2003, I had a 120GB disk, divided into 40 and 80GB volumes. When I switched from Windows 98 to Windows XP and converted the disk with FAT32 V NTFS, I got about 1GB of freed up disk space. At that time this was a significant “increase”.

To find out which file system is used on the hard disk volumes of your PC, you need to open the volume properties window and on the tab "Are common" read this data.

Volume is a synonym for a disk partition; users usually call a volume “drive C”, “drive D”, etc. An example is shown in the picture below:

Currently, disks with a capacity of 320GB or larger are widely used. Therefore I recommend using the system NTFS for optimal use of disk space.

Also, if there are several users on the PC, NTFS allows you to configure file access so that different users cannot read and change the files of other users.

In organizations, when working on a local network, system administrators use other NTFS capabilities.

If you are interested in organizing access to files for several users on one PC, then the following articles will describe this in detail.

When writing this article, materials from the sites ru.wikipedia.org were used.

Author of the article: Maxim Telpari
PC user with 15 years of experience. Support specialist for the video course "Confident PC User", after studying which you will learn how to assemble a computer, install Windows XP and drivers, restore the system, work in programs and much more.

Make money with this article!
Register in the affiliate program. Replace the link to the course in the article with your affiliate link. Add an article to your site. You can get a reprint version.