Export (0) Print
Expand All

2.3 Compound File FAT Sectors

The FAT is the main allocator for space within a compound file. Every sector in the file is represented within the FAT in some fashion, including those sectors that are unallocated (free). The FAT is a sector chain made up of one or more FAT sectors.

5ce584a2-155d-4df9-ad59-14e351fa8205

Figure 11: Sectors of a FAT array

The FAT is an array of sector numbers that represent the allocation of space within the file, grouped into FAT sectors. Each stream is represented in the FAT by a sector chain, in much the same fashion as a FAT file system.

The set of FAT sectors can be considered together as a single array. Each entry in that array contains the sector number of the next sector in the chain, and this sector number can be used as an index into the FAT array to continue along the chain.

Special values are reserved for chain terminators (ENDOFCHAIN = 0xFFFFFFFE), free sectors (FREESECT = 0xFFFFFFFF), and sectors that contain storage for FAT sectors (FATSECT = 0xFFFFFFFD) or DIFAT Sectors (DIFSECT = 0xFFFFFFC), which are not chained in the same way as the others.

The locations of FAT sectors are read from the DIFAT, which is described below. The FAT is represented in itself, but not by a chain. A special reserved sector number (FATSECT = 0xFFFFFFFD) is used to mark sectors allocated to the FAT.

A sector number can be converted into a byte offset into the file by using the following formula: (sector number + 1) x Sector Size. This implies that sector #0 of the file begins at byte offset Sector Size, not at 0.

The detailed FAT sector structure is specified below.


0

1

2

3

4

5

6

7

8

9
1
0

1

2

3

4

5

6

7

8

9
2
0

1

2

3

4

5

6

7

8

9
3
0

1

Next Sector in Chain (variable)

...

Next Sector in Chain (variable): This field specifies the next sector number in a chain of sectors.

  • If Header Major Version is 3, then there MUST be 128 fields specified to fill a 512-byte sector.

  • If Header Major Version is 4, then there MUST be 1024 fields specified to fill a 4096-byte sector.

The last FAT sector can have more entries that span past the actual size of the compound file. In this case, the entries that cover past end-of-file MUST be marked with FREESECT (0xFFFFFFFF). The size of a compound file is determined by the index of the last non-free FAT array entry. If the last FAT sector contains an entry FAT[N] != FREESECT (0xFFFFFFFF), then the file size MUST be at least (N + 1) x (Sector Size) bytes in length.

Value Meaning

DIFSECT
0xFFFFFFC

DIFAT Sectors (DIFSECT = 0xFFFFFFC), which are not chained in the same way as the others.

FATSECT
0xFFFFFFFD

Sectors that contain storage for FAT sectors (FATSECT = 0xFFFFFFFD).

ENDOFCHAIN
0xFFFFFFFE

Chain terminators (ENDOFCHAIN = 0xFFFFFFFE).

FREESECT
0xFFFFFFFF

Free sectors (FREESECT = 0xFFFFFFFF).

 
Show:
© 2014 Microsoft