Documenting MBR and FAT32: Insights and Structure

22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 17 AlexandruPaul Copil Home All posts About Tags Github MBR LBA FAT32 Posted on Mar 12 2019 Notes before reading This post is intended to document my experience with FAT32 LBA MBR within the context of Classic Kernel and the microSD EEMCA controller Notation regarding addresses and values are in Little Endian as it is in all references 13 Mar Updated based on more hands down experience MBR Introduction MBR Master Boot Record is a special sector on a partitioned disk which holds information on the logical partitioning of the physical disk and what the underlaying file system is and how where it stored files and other such entries MBR is a rather old concept which was first introduced in 1983 for IBMPC compatible machines Nowadays MBR is getting replaced by GPT GUID Partition Table The main reason behind thing is the disk size limit which comes with MBR 2 TiB Sector Layout There are multiple structure to the MBR layout Each one brings its own minor or major changes to the original design The one rule is that the sector must fit inside the MBR sector size of 512 bytes Classical generic MBR Modern standard MBR AAP MBR NEWLDR MBR ASTNEC MSDOS and SpeedStor MBR Ontrack Disk Manager MBR Classical Generic MBR Usually when first loading a sector from disk its best to check the 2 bytes boot signature at address offset 0x1FE Now the littleendian order of the 2 bytes is expected to be 0xAA55 but it has been often mixed in documentation and official documents as 0x55AA My honest advice to you is to check for both cases But remember that the official implementation has 0x55 at offset 0x1FE and 0xAA at 0x1FF The diagrams below showcases the structure of a Generic MBR including a detailed view inside the contents of a partition entry Boot Sector Partition 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 27 Partition entry ADDRESS DESCRIPTION SIZE 0x0000 Bootstrap code area 446 bytes 0x01BE Partition entry 0x01CE 0x01DE 0x01EE 16 bytes Partition entry 16 bytes Partition entry 16 bytes Partition entry 16 bytes 0x01FE 0x01FF Boot signature 0x55 0xAA 2 bytes LOCAL ADDR 1 byte Status 0x80 active 0x00 invactive 0x00 0x01 0x01BE 0x01BF CHS Address of first abs sector Head Sector Cylinder 3 bytes 0x01C2 0x04 Parition Type 0x0E FAT16 LBA 0x0C FAT32 LBA 1 byte 0x05 0x01C3 CHS Address of last abs sector Head Sector Cylinder 3 bytes 0x08 0x01C6 LBA of first abs sector 4 bytes 0x0C 0x01CA Number of sectors in partition 4 bytes You can safely ignore the Bootstrap Code area The important fields for the MBR are the partition entries 0x01BE 0x01CE 0x01DE 0x01EE and as mentioned above the signature Boot Sector BOOT CODE 446 bytes 0x0000 MBR 0x0200 MBR Partition 4 16 bytes SIGNATURE 0x55 0xAA Partition 3 16 bytes Partition 2 16 bytes Partition 1 16 bytes Partition 0x10 Status Flag 1 byte CHS Start 3 bytes Type 1 byte CHS End 3 bytes LBA 4 bytes Number of sectors 4 bytes 0x00 When reading a partition entry from the MBR make sure to check the status field 0x00 has the value 0x80 Next check the partition type in this case to be FAT32 and to support LBA The linked table has all the 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 37 common and less common partition types LBA Introduction LBA Logical Block Allocation is a common scheme used for specifying the addresslocation of blocks of data as they are stored on disk Blocks are located by an index counting up from 0 This fits in with MBR as the MBR partition must support CHS addressing LBA abstracts the cylinder layer There isnt much to be said about LBA as it is only a scheme for simplifying disk sectors access But its worth acknowledging the existence of LBA because different File Systems have version which may support it and version which may not This can be determined based on the partition type FAT Introduction FAT File Allocation Table is one of the most basic file system architectures FAT is robust simple and can provide performance even in lightweight implementations but its no competitor to modern file system which offer scalability and reliability Originally designed in 1977 and intended for Floppy Disks FAT was soon after adopted by DOS and Windows9x systems Due to its popularity in desktop environments and the evolution of storage sizes FAT now has three major versions not counting the original 8 bit designthe number represents the table element bits FAT12 FAT16 FAT32 FAT has since been cut out as the default File System from Windows machines but it still remains popular in the portable media devices market Layout 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 47 Volume Boot Record Reserved Sectors FAT 1 FAT 2 Clusters The first reserved sector 0 is also known as Boot Sector or Volume Boot Record VBR This area contains the BIOS Parameter Block BPB which contains the most basic information about the file system This part is discussed in detail below The FAT 1 and FAT 2 are the actual allocations tables the FAT 2 table is only a redundancy table and its not usually used Clusters This is where all the actual file and directory data is stored FAT32 typically commences the Root Directory Table in cluster number 2 the first cluster of the Data Region Boot Sector By far the most cumbersome design when it comes to FAT from my experience This was mainly by the conflicting nature of this working implementation of a FAT file system and the rest of the documentation available online 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 57 The digram below is based on 1 and 2 Its hard to create a simple representation when taking in consideration all the backwards compatibility introduced by Microsoft over the years Boot Sector FAT32 EBPB 0x0000 Jump Instruction 3 0x0003 8 OEM Name 0x000B 2 Bytes per logical sector 0x000D 1 Logical sector per cluster Number of reserved logical sectors 2 0x000E Number of File Allocation Tables 1 0x0010 0 for FAT32 see address 0x2C 2 0x0011 Total logical sectors 2 0x0013 Media descriptor 1 0x0015 0 for FAT32 see address 0x24 2 0x0016 2 0x0018 Physical sectors per track 2 0x001A Number of heads for disks with INT 13h CHS geometry 4 0x001C Count of hidden sectors preceding the partition that contains this FAT volume 4 0x0020 Total logical sectors DOS 331 BPB DOS 20 BPB 4 0x0024 Logical sectors per file allocation table 2 0x0028 Mirroring flags 2 0x002A Version 4 0x002C Root directory cluster 2 0x0030 Location of FS Information Sector 2 0x0032 Location of backup sectors 12 0x0034 Reserved Boot File Name 1 0x0040 Physical drive number 1 0x0041 Flags 1 0x0042 Extended signature 0x29 or 0x28 0x0043 4 Volume serial number 0x27 for FAT1216 11 0x0047 Volume Label 0x2B for FAT1216 8 0x0052 Filesystem type ADDRESS DESCRIPTION SIZE bytes Out of all these values there are only few of interest when handling a FAT32 File System 0x0B 2 bytes Bytes per sector value is 512 bytes 0x0D 1 byte Sectors per cluster a power of two 0x0E 2 bytes Number of reserved sectors common value is 0x20 0x10 1 byte Number of FATs value is 2 0x24 4 bytes Sectors per FAT varies based on disk size 0x2C 4 bytes Root directory cluster common value is 0x00000002 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 67 After checking these variables to make sure they fit your expectations you can extract some useful variables starting LBAs for each of the regions Cluster Map A file will occupy at least one cluster depending on its size A file taking up more than one cluster will be represented using a chain of clusters A chain of cluster may be fragmented across the Data Region There are special entries better explained here Its important to note the difference between a cluster and sector Normally a cluster can be found across multiple sectors usually at least 8 sectors giving a cluster size of 4096 bytes A cluster ID can be transformed into an LBA value by applying the following formula lba clusterstartlba clusterid 2 sectorspercluster The 2 is applied because there are no cluster 0 or 1 and clusters IDs begin from 2 The clusterstartlba will be obtained from the Directory Table starting from the root directory table Directory Table r e a d m e t x t Name 8 bytes Ext 3 bytes Atr 0x0000 Cluster High 2 bytes 0x0000 0x12AB34CD Size Cluster Low 2 bytes is Read Only bit 0 is Hidden is System File is Volume ID is Sub directory has been changed 0 0 bit 7 The entries are 32 bytes long each The first 11 bytes are the file name and extension 8 byte name 3 byte extension These are padded by spaces if the name is not long enough or shortened LARGEFILENAMESOMETHING becomes LARGEF1SOM where 1 is the shortened entry number in order to support multiple copies with the same short name and SOM is simply the short version of SOMETHING Its important to note and as mentioned above the only good thing directory entries will provide are the first cluster number and some information about the file as seen in the diagram The first directory table youll have access to is the root directory table which is located on the Boot Record When reading the directory table entries always check the first byte of the name Based on the value you can tell a couple of things 0xE5 Unused 0x00 End of directory table After validating the entry you can now extract the first cluster value by combining the clusterlower and clusterhigher into a 4 byte value With the cluster now you can perform a lookup into the FAT clusters Down the rabbit hole By this point you should have access to the LBA of each region boot record reserved sectors FATs data and the cluster value of the file were looking for The FAT32 table is a big array of 32bit entries where each ones position in the array corresponds to a cluster number and the value indicates the next cluster for the file You can think of this as a singly linked list but not really or more like an array where each value is another index inside the array 22092022 0000 MBR LBA FAT32 AlexandruPaul Copil httpscplliposts20190312mbrfat 77 At this point all you have to do is load up the starting LBA of the FAT tables and then use your cluster number as an offset From there you will keep walking the clusters until you reach a value of 0xFFFFFFFF Ive seen 0x00000000 used in some cases best check for both References Master boot record Wikipedia Logical block addressing Wikipedia Partition Table OSDev Wiki Partition type Wikipedia raspi3tutorial0Dreadfile bztsrcgithub File Allocation Table Wikipedia Design of the FAT file system Wikipedia BIOS parameter block Wikipedia Pauls 8051 Code Library Understanding the FAT32 Filesystem 2021 AlexandruPaul Copil Archie Theme Built with Hugo