FAT32 Structure Information - Introduction to MBR and FAT32 Boot Sector

What is the Master Boot Record?

The Master Boot Record (MBR) is essentially the same for all operating systems. It's located on the very first sector of your hard drive – Track 0, Head 0, Sector 1 – which makes it the first code run by a computer after it has finished its hardware checks (POST) and control has been passed to the boot drive. It also contains the Partition Table, which defines the different sections of your hard drive. In short, if anything happens to this tiny 512-byte region, your hard drive is toast.

• Partition entry (part of the MBR)

• Cylinder/Sector Coding

Back in those days, when you had 10 megabyte hard disks and 8086 processors, code space was very precious, so they did everything they could to save space. Unfortunately, we still have to live with that today, but fortunately, they invented a new system for translating the addresses, so that the 1024-track limit isn't really a problem for new computers. On older computers, you usually need some kind of overlay system to make them see the whole disk.

Well, to get the Sector you AND it with $3F. To get the Cylinder, you take the high byte and OR it with the low byte shifted left by two bits and ANDed with $C0. This is hard to explain, so I'll just show you my two Pascal programs (one for encoding, one for decoding) the Cylinder/Sector. Hopefully you can follow along even if you don't know Pascal.

Function CylSecEncode(Cylinder, Sector: Word): Word; Begin CylSecEncode := (Low(Cylinder) shl 8) or (High(Cylinder) shl 6) or Sector; End;

Procedure CylSecDecode(var Cylinder, Sector: Byte; const CylSec: Byte); begin Cylinder := Hi(CylSec) or ((Lo(CylSec) and $C0) shl 2); Sector := (CylSec and $3F); end;

List of Partition Types (UTF-8)

There are many others, but I have listed only those that relate to Microsoft's operating system.

Read Multiple Partitions

While it's unlikely to have multiple partitions on a FAT32, it works in the same way as FAT16. The first partition is the primary one, and everything else is stored within an extended partition. Reading these extra partitions is a bit tricky (not much, just a little). The first entry in the partition table shows where the primary partition is (its size, starting and ending sectors). The second entry in the partition table shows where the entire extended partition is located (which may include more than one partition). To read more partitions, you need to go to the starting location of the extended partition and read the first sector. It works like an MBR. Where the code would be is empty, and the first entry in the partition table points to the next partition on the drive, and if there are more partitions, an extended partition will appear again, just like before. However, all references to sector numbers are relative to this new MBR point, making it a virtual drive. In case that doesn't quite make sense (and by the way, I can understand if it doesn't, given the way I explained it), let me show you how a drive with three partitions would be set up.

The Master Boot Record (MBR) of the entire drive

Entry #1 - Points to Partition #1
Entry #2 - Points to the entire extended partition

You read the first sector of that extended partition, and there's another MBR.

Extended Partition's MBR (Master Boot Record)

Entry #1 - Points to the starting location of Partition #2 Entry #2 - Points to the remaining extended partition space after Partition #2

Now all references to sector numbers (especially the entry at offset 08h) are relative to the beginning of the extended partition, not the beginning of the disk. However, the CHS (Cylinder, Head, Sector) numbers are still correct.

You read the first sector of that extended partition, and there's the next MBR.

"MBR of Rest of Extended Partition" can be translated as "Master Boot Record of the Remaining Part of the Extended Partition". MBR stands for Master Boot Record, which is an essential part of a hard disk or storage device responsible for loading the operating system. "Extended Partition" refers to a special type of partition that can contain multiple logical drives. "Rest of the Extended Partition" denotes the remaining portion of the extended partition beyond any defined areas.

Entry #1 - Partition #3 Score
Entry #2 has no record, as this is the last partition.

If there were another partition, the same would happen again, and so on, until the last one.

FAT32 Boot Sector Information

This information is stored in the first sector of each partition.

"File System Information Sector command"

There is usually a second sector on the partition, though I believe it can be moved since it's referenced from the boot sector. I don't understand this part completely, but I know where the important fields are.

FAT32 File System Layout

Clustering

A cluster is a group of sectors on a hard drive that contain information. A 4K cluster contains 8 sectors (512 * 8 = 4096). Each cluster has a location in the FAT. When you look at an entry in the FAT, the number will tell you whether the cluster contains data, if the data has ended, or if there are more clusters to follow. All data on the partition starts from Cluster #2. If the FAT entry is 0, it means the cluster is free. If the FAT entry is 0FFFFFFFh, this is the last entry in the chain.

This was a big gap in my understanding. I could find nowhere that explained the meaning of the numbers in the FAT. I could tell where a chain ended by looking at a FAT32 drive, but I had no idea what indicated a “bad cluster,” or what the largest valid number was for displaying data.

Currently, you can use the following formula to calculate the maximum effective cluster in a partition:

(Sectors in partition - Sectors per FAT * 2 - Reserved sectors) / Sectors per cluster

If the result of that division has a remainder, it simply means that there are a few extra clusters at the end of the partition (not enough to form another cluster), which you can ignore.

Table of Contents

When looking at the file system at a lower level, another aspect is the directory table. This stores all the entries for files and directories. Essentially, the only difference between a FAT16 and a FAT32 directory entry is that the reserved OS/2 bytes in the short filename structure (offset 20 [14h]) are replaced by the high word of the cluster number (since it is now 4 bytes instead of 2).

File Allocation Table

Footnote

1 - LBA: Logical Block Addressing - Uses extended features built into newer BIOSes to access data beyond the 8GB limit, or accesses the drive purely in LBA mode instead of CHS (Cylinder, Head, Sector) mode.

Additional Tip: Use Hard Drive Recovery Software Tools to retrieve lost data from FAT32 hard drive

If you accidentally deleted, removed or formatted data from a FAT32 hard drive, USB or other storage device, do not panic. Your best bet is to let the Data Recovery Wizard tool help! Here, we recommend that you try using the Data Recovery Wizard tool which allows you to effectively recover all lost data from deletion or formatting in just 3 simple steps. Download it for free now and get back all your lost FAT32 data: