Data Recovery Software :: File systems :: FAT recovery ::

FAT Data Structures (Boot Sector)

Boot Sector

The boot sector is located in the first sector of FAT file system and contains the bulk of the file system category of data. FAT12/16 and FAT32 have different versions of the boot sector, but they both have the same initial 36 bytes. The data structure for the first 36 bytes is given in table.

Data structure for the first 36 bytes of the FAT boot sector

Byte Range Description Essential
0–2 Assembly instruction to jump to boot code. No
3–10 OEM Name in ASCII. No
11–12 Bytes per sector. Allowed values include 512, 1024, 2048, and 4096. Yes
13–13 Sectors per cluster (data unit). Allowed values are powers of 2, but the cluster size must be 32KB or smaller. Yes
14–15 Size in sectors of the reserved area. Yes
16–16 Number of FATs. Typically two for redundancy, but according to Microsoft it can be one for some small storage devices. Yes
17–18 Maximum number of files in the root directory for FAT12 and FAT16. This is 0 for FAT32 and typically 512 for FAT16. Yes
19–20 16-bit value of number of sectors in file system. If the number of sectors is larger than can be represented in this 2-byte value, a 4-byte value exists later in the data structure and this should be 0. Yes
21–21 Media type. According to the Microsoft documentation, 0xf8 should be used for fixed disks and 0xf0 for removable. No
22–23 16-bit size in sectors of each FAT for FAT12 and FAT16. For FAT32, this field is 0. Yes
24–25 Sectors per track of storage device. No
26–27 Number of heads in storage device. No
28–31 Number of sectors before the start of partition. No
32–35 32-bit value of number of sectors in file system. Either this value or the 16-bit value above must be 0. Yes

The first value in the boot sector, bytes 0 to 2, is a boot code instruction tells the computer where to find the code needed to boot the operating system. If the file system is not used to boot the computer, the value is not needed. You could use this value to identify what boot code is used. Note that DOS and Windows require that the value be set on non-bootable file systems, but other OSes, such a Linux, do not.

From bytes 36 onward, FAT12 and FAT16 have a different layout than FAT32. The one value that they both have in common is the signature 0x55 in byte 510 and 0xAA in byte 511. Note that this is the same signature at the same location that the DOS partition table uses in its first sector (you'll also see it again in the first NTFS sector). The data structure values for the rest of the FAT12 and FAT16 boot sector are given in table.

Data structure for the remainder of the FAT12/16 boot sector

Byte Range Description Essential
0–35 See previous table. Yes
36–36 BIOS INT13h drive number. No
37–37 Not used. No
38–38 Extended boot signature to identify if the next three values are valid. The signature is 0x29. No
39–42 Volume serial number, which some versions of Windows will calculate based on the creation date and time. No
43–53 Volume label in ASCII. The user chooses this value when creating the file system. No
54–61 File system type label in ASCII. Standard values include "FAT," "FAT12," and "FAT16," but nothing is required. No
62–509 Not used. No
510–511 Signature value (0xAA55). No

The data structure for the rest of the FAT32 boot sector is given in table.

Data structure for the remainder of the FAT32 boot sector

Byte Range Description Essential
0–35 See first table Yes
36–39 32-bit size in sectors of one FAT. Yes
40–41 Defines how multiple FAT structures are written to. If bit 7 is 1, only one of the FAT structures is active and its index is described in bits 0–3. Otherwise, all FAT structures are mirrors of each other. Yes
42–43 The major and minor version number. Yes
44–47 Cluster where root directory can be found. Yes
48–49 Sector where FSINFO structure can be found. No
50–51 Sector where backup copy of boot sector is located (default is 6). No
52–63 Reserved. No
64–64 BIOS INT13h drive number. No
65–65 Not used. No
66–66 Extended boot signature to identify if the next three values are valid. The signature is 0x29. No
67–70 Volume serial number, which some versions of Windows will calculate based on the creation date and time. No
71–81 Volume label in ASCII. The user chooses this value when creating the file system. No
82–89 File system type label in ASCII. Standard values include "FAT32"; but nothing is required. No
90–509 Not used. No
510–511 Signature value (0xAA55). No

The difference between the FAT12/16 and FAT32 boot sector is that the FAT32 sector includes data to make the file system more scalable and flexible. There can be different policies for how the FAT structures are written to and a backup copy of the boot sector exists. There is also a version field, but there seems to be only one version used by Microsoft at the time of this writing.

The data between bytes 62 to 509 in a FAT12/16 file system, and bytes 90 to 509 in a FAT32 file system do not have a specified purpose, but are typically used to store boot code and error messages.