NOTES ON THE STRUCTURE OF THE VFAT FILESYTEM
(This documentation was provided by Galen C. Hunt and lightly annotated by Gordon Chaffee <chaffee@bmrc.berkeley.edu>, see Gordon’s VFAT home page).
This document presents a very rough, technical overview of my knowledge of the extended FAT file system used in Windows NT 3.5 and Windows 95. I don’t guarantee that any of the following is correct, but it appears to be so. Also note that all of the information in this document was derived from many hex dumps of directory structures of disks created using a Windows 95 beta.)
The extended FAT file system is almost identical to the FAT file system used in DOS versions up to and including 6.223410239847 :-). The significant change has been the addition of long file names. Theses names support up to 255 characters including spaces and lower case characters as opposed to the traditional 8.3 short names.
Here is the description of the traditional FAT entry in the current Windows 95 filesystem:
struct directory { // Short 8.3 names
unsigned char name[8]; // file name
unsigned char ext[3]; // file extension
unsigned char attr; // attribute byte
unsigned char lcase; // Case for base and extension
unsigned char ctime_ms; // Creation time, milliseconds
unsigned char ctime[2]; // Creation time
unsigned char cdate[2]; // Creation date
unsigned char adate[2]; // Last access date
unsigned char reserved[2]; // reserved values (ignored)
unsigned char time[2]; // time stamp
unsigned char date[2]; // date stamp
unsigned char start[2]; // starting cluster number
unsigned char size[4]; // size of the file
};
The lcase field specifies if the base and/or the extension of an 8.3 name should be capitalized. This field does not seem to be used by Windows 95 but it is used by Windows NT. The case of filenames is not completely compatible from Windows NT to Windows 95. It is not completely compatible in the reverse direction, however. Filenames that fit in the 8.3 namespace and are written on Windows NT to be lowercase will show up as uppercase on Windows 95.
Note that the "start" and "size" values are actually little endian integer values. The descriptions of the fields in this structure are public knowledge and can be found elsewhere.
With the extended FAT system, Microsoft has inserted extra directory entries for any files with extended names. (Any name which legally fits within the old 8.3 encoding scheme does not have extra entries.) I call these extra entries slots. Basically, a slot is a specially formatted directory entry which holds up to 13 characters of a files extended name. Think of slots as additional labeling for the directory entry of the file to which they correspond. Microsoft prefers to refer to the 8.3 entry for a file as its alias and the extended slot directory entries as the file name.
The C structure for a slot directory entry follows:
struct slot { // Up to 13 characters of a long name
unsigned char id; // sequence number for slot
unsigned char name0_4[10]; // first 5 characters in name
unsigned char attr; // attribute byte
unsigned char reserved; // always 0
unsigned char alias_checksum; // checksum for 8.3 alias
unsigned char name5_10[12]; // 6 more characters in name
unsigned char start[2]; // starting cluster number
unsigned char name11_12[4]; // last 2 characters in name
};
If the layout of the slots looks a little odd, it’s only because of Microsoft’s efforts to maintain compatibility with old software. The slots must be disguised to prevent old software from panicing. To this end, a number of measures are taken:
Because the extended FAT system is backward compatible, it is possible for old software to modify directory entries. Measures must be taken to insure the validity of slots. An extended FAT system can verify that a slot does in fact belong to an 8.3 directory entry by the following:
proceeding files... slot #3, id = 0x43, characters = "h is long" slot #2, id = 0x02, characters = "xtension whic" slot #1, id = 0x01, characters = "My Big File.E" directory entry, name = "MYBIGFIL.EXT"
Note that the slots are stored from last to first. Slots are numbered from 1 to N. The Nth slot is or’ed with 0x40 to mark it as the last one.
for (sum = i = 0; i < 11; i++)
sum = ( ((sum & 1) << 7) | ((sum & 0xfe) >> 1) ) + name[i];