Searching files in FAT16 partition

What data recovery tools to buy if you want to start a data recovery business?

Free video data recovery training on how to recover lost data from different hard drives?

Where to buy head and platter replacement tools at good prices?

Data recover case studies step by step guide

I want to attend professional data recovery training courses

Let’s see a boot sector (start sector is DBR) in FAT16 after advanced format. The OEM mark is MSWIN5.0.

From the chart we can see, the parameters of file system are all record in BPB parameter table of DBR; with the parameter table, system can locate FAT, FDT and DATA. The meaning of the parameters is shown in the following chart:
Another way to express:

We have known that system can divide all sectors located in the same cylinder into a partition with cylinder as the division surface in partition. System manages partition in 5 regions. There is no special rule between the 5 regions and partition, thus the numbler of DATA sectors is probably not a integer; in other words, when executing the cluster manament of DATA, the last several sectors do not rightly form a cluster. So the system can not execute cluster management to these secotrs. By WinHex, we call them residual sectors.Now let’s see how systerm divide and organize the 5 regions:

Firstly, when formating, system will calculate that how many sectors should be covered by FAT, that is how many sectors should be allocated to FAT. As the following chart, we have known the number of sum sectors, reserved sectors and covered secotrs by FDT, thus we can calculate the number of FAT sectors and DATA sectors.

Obviously, FAT sector number has a close relationship with DATA sector number. Because the  more FAT occupies, the less DATA does, thus there need not so large FAT; while FAT reduces, DATA enlarges, and FAT should be larger; so there is a balance point. According to the balance point, we can get the most reasonable assignment (the most optimal principle), thus getting a formula to calculate the FAT length:

FAT sectors= {[(Total sectors – Reserved sectors – FAT sectors*2 – FDT sectors)/512]*2 + 4}/512 The formula is a quite complex one, here is just an example. Because calculates manually quite complex, here does not calculate the best assignment, only carries on the confirmation. Actually when some systems formatted small partition, because FAT is small, directly uses the sector total and each cluster of sector number to calculate FAT is also a good and convenient way.

FAT16 partition example:
FAT= {[(240912-1-235*2-32)/4]*2+4}/512=234.7822, take an integer 235. Then there is a problem, if the FAT sector number is too big, the manageable DATA sectors certainly surpasses the actual size of DATA region. Will it write in the data to the outside the DATA region? Of course, system will not have this problem, for it does not use all FAT last sectors but uses part that adapts with DATA. According to the computation, we can obtain the relations among regions as following:

In addition, please note that in practice, the length of FAT often does not meet the optimal principle. If thus, we need just manage according to the actual size, for it does not affect much.

Reserved sectors, FAT and FDT are recorded in DBR.According to these parameters the entrance of each region can be determined. The FDT records parameters of sub-directory or files under the root directory. According to these parameters, it may determine the first cluster of file or direcotry in DATA region and the start point of cluster chain in FAT. Then, make use of the cluster chain in FAT to track the file or direcotry in DATA until the file or directory ends. Thus we can know the whole file/directory storage situation in disk. Thereinto, in FAT, there are different situations in  file registration, such as backwards, forwards and cross record; this may be have something with
the order that the system finds the free cluster when writing files. Here is an example of a file composed by two clusteres:

In practice, system manages files and directories in this way. Also we may see that DATA is a very special region, it only has start and end point; the region itself does not have any relation with the file or directory. DATA only records the data, as for relation among the data, it is explained by FDT and FAT. There are only FDT and FAT as the entrance of DATA region, therefore, FDT and FAT are extremely important to the DATA region. If FDT and FAT are destroyed, it is unable to explain the actual meaning of data in DATA. It is system’s responsibility to explain them.