We are talking about the Fat file system here in course eight And in module before we're going to talk about the file allocation table, we're going to take a look at how it works and how we read it. The facts of the file allocation table is the call. What they do is they track cluster allocation which clusters are in use being occupied by a file and which clusters are not in use and available to be written to? Yeah. File allocation table has an entry for every cluster on the volume. Fat one and fat too should be the same because Fat too is a backup for recovery purposes. If that one becomes corrupted, they are located in the system area on all versions of that. And again, they're used to track cluster allocation status, whether the cluster is being occupied by a file or it's available to be written to each of these entries which represents a cluster on the drive will give us the location of the next cluster of that file here is kind of a visual example of what the facts do we have? Our system area and our fats are in the system area now out in the data area we have our files, we have a file here just written. And cluster too, cluster two Points to cluster six where the rest of this file lives. So this file is what we call fragmented. Yeah. In other words it's not right next to each other. Part of it is in cluster too. And then the other part of it is in cluster six. If we look at cluster three, Cluster three points us to cluster four and then we have an end of file marker E o f. This would be called a contiguous file Because cluster three is right next to cluster four. And then looking at our diagram and cluster five, we just have an end of file marker which this tells me that the file occupying Cluster five only needs one cluster so it's not big enough to need more than one cluster. A fat writes the data to the first available cluster. So if we deleted one of these and wrote a new file it could go into this empty space. Now we're going to see Type three Types of entries in the fat, you're going to see this marker, a first offense offense or less and that indicates end of file that tells us we're either at the end of a cluster chain or if it's only occupies one cluster will just see that marker in the cluster that represents that file on the draft. You could see 000000. And this indicates that the cluster is not being used, it's available to be written to or we'll see a pointer to the next cluster And down here we can see this is what a fat table is going to look like when we view it with our tools. This F A f f f f Os. This is what we call a media descriptor generally indicates fixed disk but it's what we call a media descriptor. These next four bites Tell us the version of Fat one looking at and since they were all maxed out at ff ff ff We know we're looking at Fat 32. Fat 32 has four byte entries. Fat 12 and 16 Have to bite entries for each cluster but we are going to focus on fat 32 because that's most likely what we'll see today. So four Byte entries. These next four bites represent cluster two because our cluster numbering out on our drives is going to start it too. So this represents cluster too and it's pointing to would have to translate that number but it's pointing to another cost around in the drive this would be the Filed clustered 3's representation and cluster to re has an end of file marker which means the file that is occupying cluster three only takes up one cluster And we had the four bytes for close to four and we have an end of file marker. Cluster five we have an entire file marker. Now we look at cluster six Cluster six points to cluster seven. If we look at the four bytes that represent cluster seven in our fat table, They pointed to cluster eight 9 10. It just goes you can see this is a long continuous file. Yes this is showing us what we have in our fat tables. It's the same fat table we looked at in the previous slide we have our media descriptor for bites, then we have our fat type. Then this The next four bytes represents cluster too. And cluster two points out to cluster 42656. If we translated and these are red the Lindy in again, If we translated 0000 86 Ao would come up with 42,665. So that's what cluster to cluster to. Points to that cluster. Now if we look at cluster three, Hesitant to file marker close to 400 and a file marker five And then cluster six Points to cluster seven. We look at the entry for cluster seven It points to eight Mr eight points to nine. And this file just goes on to the very end. We have clustered 20 down here Pointing to cluster 21. So that would be how we would look at our fat table. We're going to do a walk through and take a look at this on disk. So please attach your NPR Bhd note that this number of your attached virtual hard drive so we can locate it. And please open up active disk editor for our walk through. The first thing we're going to do is attach R V H. D. So we'd go to actions, attach PhD would navigate out. Find R M B R V H. D. Mhm click open and it will attach the V H. D. For us. Yeah. Yeah. Once we've done that, mm hmm. We can see R V H. D. Remember the drive number. Mhm. Now we're going to open Active disk editor. Mhm. Once Active disk editor opens, we're going to open a logical volume, again the same logical volume we did for our last walk through and we're going to take a look at the fat file table and see how our tool shows it to us. Yes. And I'm going to show you an easier way to read it. So we're going to select open disk. Mhm. We're going to select volumes because we want to look at the volume, not a physical disk. And we are going to select our fat 32 volume. That is 200 MB in size. My name is Dr S and we're going to open it. Okay. Yeah. Again when it opens by default this tool will take you to the volume boot record. Mhm. We've already taken a look at this so we know how many sectors we have per cluster And just in case it's four sectors per cluster In 512 bytes per sector. Yeah, now we're going to go up to the navigate button and we're going to navigate to Fat one and we look at this, it's a little hard to read But we know each one of our entries is four bytes in length. So what we're going to do is we're going to go to file mhm Preferences and we're going to change our view in bytes per line from 16 to 4 and we're going to click OK once that opens up it makes it a little bit easier for us to read our fat table. The first entry at our fat table is going to be the media descriptor. Mhm. And we have F a f f f f o f and this usually indicates a fixed disk. Our next entry, our next four byte entry in our fat table is going to tell us what version of fat we're looking at and we can see we have ff ff ff ff. So we know we're looking at Fat 32. This next entry down here represents cluster too because cluster numbering starts at two out on the volume, so cluster too, Cluster two in this particular fat table has an end of file marker in it. That means that the file occupying cluster to only needs one cluster. We looked down, we see our entry for cluster three. This entry represents cluster three, it's telling us its allocation status, it's telling us it is allocated and it doesn't point to another cluster. So we know that the file and cluster three only takes up one cluster. We look at the Representation for Cluster four. We see the same thing, we look at the entry for cluster five, we see the same thing 6789 10, 11, 12. Now, when we look at the entry for cluster 13. Mhm And we highlight it little indian. Yeah, We can see that the entry for cluster 13 these four bytes represent close to 13 and they have a pointer in them and that pointer is telling us to go to, we look at our data interpreter, cluster 14, we look at the entry for cluster 14 and that's pointing us to cluster 15. Mhm. We could see it. Our data interpreter or zero. f is 15. So we look at the representation the entry in our Table for cluster 15 And it points to cluster 16. We look at the fat table entry for cluster 16 right below and it points us to cluster 17. So we look at the entry for cluster 17 And it points us to cluster 18. And when we look at the four Byte fat table entry For cluster 18 we see an end of file marker. Mm hmm. The company people. Yeah, if we continue down the table. Mhm. We can see that. Yeah. Mhm. Cluster 19 also has an end of file marker in it. Cluster 20 has an end of file marker in it. Yeah. We look at the Fat Table entry for Claim 21. We can see all zeros and we know that all zeros means that the clusters are marked as available to be written to. Mhm. Know that. To see a cluster in the middle of the table marked is available to be written to maybe an indication that a file was deleted there. Mhm. If we look down in our fat table, we see more into file markers and we see more files that are contiguous meaning that the clusters are one right after the other. They're not fragmented but we're not jumping from one cluster to another. And that would be how we would take a look at our fat table. Yeah.
