Search code examples
fat

Having trouble identifying what is wrong in this FAT

enter image description here

So I'm going through the table starting at 0000. I see 006E and that sends me down to row 0060 column E. I see 00A2 which sends me to row 00A0 colum 2. I see 00EA which sends me to row 00E0 row A. I see FFF0 indicating end of cluster. Is this wrong because more clusters are left in table? Am i going about this compeltely wrong??

Solution

  • This does not strike me as a particularly realistic presentation of a FAT. In the real world, the fact that each entry is two bytes long would mean that you need to multiply the cluster numbers by 2 to find their actual location in the table; that's clearly not workable here, since about half of the cluster links would point outside of the FAT as shown. If you're supposed to interpret the numbers as location offsets instead of actual cluster numbers, then they'd have to all be even - that odd 0049 at 00DA would be invalid.

    You cannot truly evaluate a FAT without looking at the disk's directories, to know where each file actually starts. That 0062 at 0000 is NOT the start of a file; notice that there is a link to 0000 at 0056, and a link to 0056 at 00D2, so perhaps 00D2 is a valid file start.

    A link that points to a FFFF unused cluster would indeed be a problem - I see at least one of those. Two links to the same cluster, or links that form a loop, would also be worth looking for.