Microsoft FAT16 and the undelete function

[zainka]

Microsoft FAT16

Hi

Hopes this is the appropriate forum to post this question.

I have been digging into the FAT16 description but have a question in how the undelete function can work for files stored in FAT16 formatted enviroments (and other FAT versions).

The FAT part of FAT16 holds a 16bit record of all clusters in the data area in a partition. Each record tells if the cluster is free, reserved, marked BAD, if its EOF or if it is a part of a linked list by holding the address for the next cluster in chain.

If a file is deleted, the directory entry for this particulary file is changed by marking first letter in file name wit a special character, this is OK, but I then also guess that all clusters which was a part of the chain belonging to this file should be marked as beeing free in the FAT, thus breaking the chain.

How can then undelete know which clusters is belonging to the deleted file? I mean, the directory entry correctly still points to the first cluster in the chain, but the corresponding cluster in the FAT should now be listed as beeing free and not point to next cluster in chain, or is this not correct. Does it still point to next cluster in a now deleted file/chain? Wouldnt this cause a problem when storing new files later and you do not find any free clusters in the FAT? Then you would have to search for deleted fiels too, before you know if there is any clusters available or not.. time consuming...

I am missing something here, this I do know since Undelete obviously works, but I cant see what.

Please help

Best regards
Vidar (Z)

 

[rancohen_2000]

Re: Microsoft FAT16

here is link that explain how undelete works:

https://www.atarimagazines.com/compute/issue157/52_Recovering_deleted_f.php

 

[zainka]

Re: Microsoft FAT16

Great information, it solved my problem, heres another one.

In FAT16, the structure is like this

1: Bootsector + reserved
2: FAT
3: copy of FAT if any
4: Root folder
5: Clusters to the end of partition storing data

Now, since value 0x0000 and 0x0001 are used in FAT to mark if a cluster is free or reserved respectively, cluster 0, and 1 can not be used, instead the cluster entries in the FAT for these two are used to store a copy of the media descriptor ++.

Is then the 2 clusters wasted space(?) or is it these two clusters which actually holds the Root folder right after FAT(?) and that this is the reason for the limited number of directory entries which can be held in the root folder? i.e. something like this

1: Bootsector + reserved
2: FAT
3: copy of FAT if any
4: Root folder (Cluster 0 and 1)
5: Clusters to the end of partition storing data (Cluster 2 to  LAST CLUSTER)

Thanks in advance
Vidar (Z)

 

[zainka]

Re: Microsoft FAT16

Found answer my self after digging houers, heres for your refference if interested.

There is no cluster 0 and 1 in FAT16 by some reason (why, i do not know). Root folder is located after FAT and number of sektors ocupied by root folder is calculated from info from 0x11 offseth in boot record. Right after the root folder the data area is located beginning at cluster #2.

In FAT32 the data area is beginning with cluster 2 RIGHT after the FAT area and root is stored in data area among the data and can contain as many files as wanted using cluster chains.

In the FAT16/32 table, the refference for cluster 0 and 1 is unused for cluster addressing leaving 2*32 bits of wasted space or eventually used to store a copy of the media descriptor ±.

Thats for now.

Edited 18oct2006:
Changed incorrect statements aboute cluster 0 and 1, now it should be correct.

 

[zainka]

Re: Microsoft FAT16

Hmm, it seems like i love talking to my self, this is the third post in a chain from me!

Well, hopes this is the last one in the chain and that someone knows the answer and wanna share with me.

Case is the Boot record of FAT16. Offset 0x3e is where the OS boot code goes. This offset is 448 bytes if sector size is 512. In my case, I am using another cind of memory which have sector size of 1024 bytes. Could I then, sinze offset 0x0b says sector size is 1024, say that os boot code is 960 bytes wide and a windows enviroment would accept this?

Second what is physical drive number, current head and signature in offset 0x24, 0x25, 0x26 respective?

Third, the media descriptor, what would this be if using a memory card SD with 1GB, can the media descriptor be ommitted? For the other flash memory we intend to use with sektor(page) size 1024, how should media descriptor be calculated if not ommitted???

thanks in advance
best regards
vidar (z)