Terminology

...

What is a byte?
A byte is 8 bits of data, which is the smallest addressable unit in modern processors.

What is a sector?
A sector is the smallest addressable unit on a storage device.

How large is a sector typically?
A sector is typically 512 bytes.

What is a cluster in FAT32 filesystems?
In FAT32 filesystems, a cluster is a group of sectors representing a chunk of data.

What is a File Allocation Table (FAT)?
A FAT is a map of files to data.

FAT32 Disk Layout

What are the three regions of a FAT32 filesystem?
The three regions of a FAT32 filesystem are:

  1. The reserved region.
  2. The FAT region.
  3. The data region.

Reserved Region

What sectors does the reserved region store?
The sectors that the reserved region stores include:

  • The boot sector.
  • The extended boot sector.
  • The file system information sector.

FAT Region

What does the FAT region store?
The FAT region stores a map to traverse the data region from cluster locations to cluster locations.

Data Region

What does the data region store?
The data region stores the actual file / directory data using the addresses from the FAT region.

...

Endianness

What byte-order does FAT32 use?
The byte-order that FAT32 uses is little endian.

What byte do you encounter first when reading from left to right?
When reading from left to right, the first byte you encounter is the least significant byte.

What must you account for when reading in numbers larger than one byte in size?
When reading in numbers larger than one byte in size, you must account for little endianness.

Do you have to account for little endianness when reading characters and why?
No, you don't have to account for little endianness when reading characters because they are one byte in size.

File Allocation Table (FAT)

What does the File Allocation Table (FAT) store?
The FAT stores a chain of all the clusters belonging to a particular file.

What is the File Allocation Table (FAT) comprised of?
The FAT is comprised of a big array of 32-bit integers.

What does each integer's position in the array correspond to?
Each integer's position in the array corresponds to a cluster number.

What does the value of an integer stored in the array indicate?
The value of an integer stored in the array indicates the next cluster of the file.

What does an End of Cluster-Chain (EoC) value indicate?
An EoC value indicates the end of the cluster chain for that file.

...

Steps to read from a FAT32 image

What are the three steps to read from a FAT32 image?
The three steps to read from a FAT32 image are:

  1. Locate, read, and extract important information from the boot sector.
  2. Locate the root directory and get the list of files and folders.
  3. Access the files and directories using information from the root directory and the FAT32 table.

Parse the Boot Sector

Where is the boot sector?
The boot sector is the first 512 bytes.

Important Boot Sector Information

What are some of the attributes which are saved in the boot sector?
Some of the attributes which are saved in the boot sector include:

  • BPB_BytesPerSec.
  • BPB_SecPerClus.
  • BPB_RsvdSecCnt.
  • BPB_NumFATS.
  • BPB_FATSz32.
  • BPB_RootClus.

...

Finding the Root Directory

How do you find the root directory after reading the boot sector?
After reading the boot sector, you find the root directory by using the root directory cluster number.

...