The FAT FSInfo data structure is used to optimize the file system space allocation operations. For this purpose, the FSInfo structure keeps track of the first free cluster and the number of free clusters.
The size of FAT is up to 6 KB on FAT12 volume and up to 128 KB on FAT16 volume, but it typically reach several MB on FAT32 volume. For this reason, FAT32 volume supports FSInfo structure in order to avoid to read over an entire FAT to look for free clusters or get count of free clusters.
- This structure is put in the FSInfo sector indicated by BPB_FSInfo. [5]
One of the downsides of the FSInfo structure is that it does not enforce the FAT implementations to keep the structure up to date. Therefore, not all FAT implementation utilizes the FSInfo structure.
- It is recommended to keep the FSInfo structure up to date by the FAT32 specification.
Table of Contents
FAT FSInfo on Disk
| FSInfo Field Name | Field Description |
| FSI_LeadSig | The signature to validate the start of FSInfo structure |
| FSI_Reserved1 | Reserved |
| FSI_StrucSig | The signature to validate FSInfo structure integrity |
| FSI_Free_Count | Last known free cluster count |
| FSI_Nxt_Free | The first free cluster number |
| FSI_Reserved2 | Reserved |
| FSI_TrailSig | The signature to validate the end of the FSInfo structure integrity |
The StrucSig, LeadSig and TrailSig signatures help the file system validate the integrity of the data into FSInfo sectors.
| FSInfo Field Name | Starting Offset In Bytes | Size of the Field |
| FSI_LeadSig | 0 | 4 |
| FSI_Reserved1 | 4 | 480 |
| FSI_StrucSig | 484 | 4 |
| FSI_Free_Count | 488 | 4 |
| FSI_Nxt_Free | 492 | 4 |
| FSI_Reserved2 | 496 | 12 |
| FSI_TrailSig | 508 | 4 |
When the sector size is larger than 512, rest of the bytes should be initialized to zero. [5]
FAT FSInfo Integrity Fields
FSI_LeadSig = 0x41615252
- The lead signature.
- Validate the start of the FSInfo structure in the sector.
FSI_StrucSig = 0x61417272
- An extra signature.
- Validate the integrity of the FSInfo structure.
FSI_TrailSig = 0xAA550000
- The trail signature.
- Validate the integrity of the data in the sector.
FAT FSInfo Free Count
The free count field of the FSInfo structure keep tracks of the the last known free cluster count on the volume.
The contents of this field must be validated at volume mount. It is subsequently maintained in memory by the file system driver implementation [1].
- This value might be incorrect and should at least be range checked (<= volume cluster count) [2]
It is recommended that this field contain an accurate count of the number of free clusters at volume dismount (during controlled
[1]
dismount/shutdown).
If it is equal to FSI_FREE_COUNT_UNKNOWN, then this field must not be used and there is no estimate for the number of free clusters. [4]
- The value 0xFFFFFFFF indicates the free count is not known. [1]
This field is furnished to approximate the free space in the FAT32 file structure [4].
FAT FSInfo Next Free
The next free field of the FSInfo structure keep tracks of the cluster number of the first available (free) cluster on the volume.
- Indicates the cluster number at which the filesystem driver should start looking for available clusters. [2]
The contents of this field must be validated at volume mount.
It is recommended that this field be appropriately updated at volume dismount (during controlled dismount/shutdown).
[1]
If it is equal to FSI_NXT_FREE_UNKNOWN, then this field must not be used and the search for a free cluster must start with cluster 2 (root_directory_cluster). [4]
- The value 0xFFFFFFFF indicates that there exists no information about the first available (free) cluster.
- This value might be incorrect and should at least be range checked (<= volume cluster count)
- Some implementations sets next free value to the last allocated cluster number. [2, 5]
This field is furnished to reduce the time to find a free cluster. [4]
FAT FSInfo Disk Locations
The backup boot sector is a feature of FAT32 volume. This is a feature to provide redundancy for the only boot sector existing on the FAT volume [5]. Starting at sector 0, there are reserved sectors as shown in the following image.
- These sectors as a group are referred to as the Reserved Region.
- The number of reserved sectors is stored in the boot sector (BPB_RsvdSecCnt). [4]
- The location of backup boor sector is indicated by BPB_BkBootSec.
- This can increase the possibility of volume recovery if the boot sector is corrupted for any reason. [5]
The FSInfo is located at sector 1 of volume. The sector following the BPB.
Also, a duplicate is maintained at sector 7.
The FSInfo structure is only found on FAT32.
FAT32 boot sector byte 48-49 stores the cector where FSINFO structure can be found although not essential. [3]
FAT FSInfo Implementation
An example implementation that reads and parses the FSInfo sector:
References
[1] Microsoft FAT32 Reference Document
[2] https://wiki.osdev.org/FAT#FSInfo_Structure_.28FAT32_only.29
[3] http://www.c-jump.com/CIS24/Slides/FileSysDataStructs/FileSysDataStructs.html
[4] https://cscie92.dce.harvard.edu/spring2021/slides/FAT32%20File%20Structure.pdf
[5] http://elm-chan.org/docs/fat_e.html#fsinfo
[6] https://learning.oreilly.com/library/view/file-system-forensic/0321268172/ch10.html#ch10lev1sec2