Understanding FAT Filesystems

The File Allocation Table in a FAT filesystem serves two out of five of the basic filesystem functions outlined previously, with some carryover into a third. When the file’s starting point is indicated by the directory entry (described later), the corresponding FAT entry serves as the starting point for locating the data. Accordingly, the FAT tracks which clusters the file uses. The FAT also tracks which allocation units (clusters) are allocated and which are not. Because the FAT is the predominant feature of the filesystem, it was only appropriate that the FAT gave this filesystem its name.

FAT began as FAT12, grew to FAT16, and exists today as FAT32. The number following FAT (12, 16, 32) describes the size of the ...

Get Mastering Windows Network Forensics and Investigation, 2nd Edition now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.