The Fat32 file system is the file system commonly used in windows os before, in this article we have to find:

1. Start sector of the first partition

2. The location of the first file file configuration table (FAT)

3. The location of the data area

4. The cluster where the file "file1.txt" is located

1 First, use HxD to open the FAT32 file to be analyzed

2 Select the file to be analyzed. After opening, in the initial sector0, that is, sector 0, we will see the master boot of the system. The 64-bit master partition table before the end mark of 55AA (Master Partition Table) ), which records the information of each partition.

offset1BE 00 means not bootable, 80 means bootable from this partition

offset1BF-1C1 means CHS (Cylinder-Head-Sector, first find cylinder, then track, then find sector addressing method) start address 000101 (window OSLITTLE-ENDIAN (smallEndianness3. Low byte order storage, that is, the low-order byte is arranged at the low address end of the memory, and the high-order byte is arranged at the high address of the memory.

offset1C2 indicates the partition flag

offset1C3-1C5 indicates the end address of CHS

offset1C6-1C9 takes up 32 bits and represents the starting sector 0000003F=63

offset1CA-1CD indicates the length of the sector

The remaining three sectors recorded as 0 means unused

3 After finding the starting sector of the first partition, we jump to the 63 sector where it is located and analyze the information in its boot record

offset7E0B occupies 16 bits and represents the number of bytes per sector in each sector. 0200 (h) = 512 byte

offset7E0D occupies 8 bits, which means sectors/cluster how many sectors each cluster has 02

offset7E0E takes up 16 bits, indicating how many sectors the content of the reserved area occupies 0022(h)=34

offset7E10 occupies 8 bits The partition has several FAT tables 2

offset7E16 occupies 16 bits represents sectors/FAT. If the number in this area is 0, jump to the 5th byte of the next line, ie offset7E24 occupies 32 bits 000002EB(h)=747 sectors

Therefore, the offset of FAT1 is [the starting position of the first partition (63 sectors where the boot record is located) + the number of sectors in the reserved area (34)]*[byte/sector (512)]=49664

The offset relative to the first partition is 49664-7E00(h)=49664-32256=17408

The location of the user data area is the next sector after the end of the FAT table, that is, the first sector of the first partition+reserved sector+FAT table sector=63+34+2*747=1591

3. Jump to sector 1591, we can see the record of the user's real files FAT Directory Entriy

The selected area is the file one information directory, and the position of offset6E88 is the attribute label of the file. When file 1 is set to 08, its bit volume label means that file1.txt is not visible when the file system is started.

offset6E9A occupies 16 bits, indicating the starting cluster of file1.txt 0011(h)=17

In FAT32, each cluster of information occupies 32 bits, 4 bytes. So starting from offsetC200, counting 17 4 bytes, found offsetC244, which is 18[00000012(h)]---19[13(h)].......34[22(h)- --FFFFFF0F (stop)

So the cluster occupied by file1.txt is 17-34