File Allocation Table (FAT) Described

All Microsoft operating systems rely upon the storage of data in fixed length blocks of bytes called clusters. The size of these blocks is dependant upon the type of storage device and the size of the storage device. For Microsoft DOS, Windows, Windows 95 and Windows 98, a File Location Table (FAT) is used to track which clusters have been allocated to a specific file. The FAT is relied upon by the operating system much like a road map to locate the data associated with a specific file. References in the FAT act as pointers and they point to clusters by numeric reference. The top four bits of the cluster number in FAT 32 are reserved and are not available for cluster enumeration. Thus, FAT 32 systems can have at most 2**28-1 or 268,435,455 clusters. The same rule of thumb applies for FAT 12 and FAT 16 systems. FAT 12 systems can have up to 4079 clusters and FAT 16 systems can have up to 65519 clusters. The four reserved bits are reserved to identify vaules meaning things like "empty", "bad sector" and "End of file" in the referenced cluster.

The FAT on a floppy diskette will typically rely upon 12-bit numbers (FAT 12). When hard disk drives are involved, Microsoft Windows and Windows 95a rely upon a 16-bit FAT. Microsoft Windows 95b and Windows 98 were designed to deal with more data and huge hard disk drives. The FAT on these newer operating systems relies upon 32-bit numbers.

The FAT and differences between one Microsoft operating system and another is covered in detail in NTI's 5-Day Computer Forensics Training Course.