3.7. Microsoft

Microsoft's formats are quite a phenomenon. Despite obvious mis-design -- missing unique identification signatures and the need for excessive calculations, for example -- the FAT formats have established themselves as standards for cross-system interchange.

All formats described in this section originated on the x86 platform and are little-endian.

3.7.1. FAT12, FAT16, and FAT32

This family of formats has a long history. They were introduced by MS-DOS and are still supported and used today in all versions of MS Windows. The format also managed to establish itself as the common denominator for disk interchange, and as a result is supported by virtually every operating system on the planet.

FAT stands for File Allocation Table, a central structure in the file system. It acts as an allocation bitmap, but also stores which clusters belong to a certain file using linked lists. As the names indicate, there are variants with entry sizes of 12, 16 and 32 bits.

One unique feature of the FAT file systems is that they are hard to identify. The first sector is called the "boot sector". It contains some parameters at the beginning; the rest of the sector is used for boot code. Identification is only possible through consistency checks of these parameters. Since the format is quite flexible, disktype only uses some of these as "hard" tests, and uses the rest to calculate a "hints score". For example, there is a two-byte signature at the end of the boot sector that is used by PC BIOSes to check for a bootable disk. It is entirely possible to encounter an otherwise valid FAT file system in the wild that lacks this signature, though.

To make the situation even worse, some other PC formats, including Microsoft's own NTFS, seem to use the same parameter block in the boot sector, for compatibility with PC BIOSes. disktype tries to avoid it, but it may still misidentify one of these as a FAT file system. Hopefully the "hints score" will help you identify such situations.

Official information on the FAT family can be found at http://www.microsoft.com/hwdev/hardware/fatgendown.asp.

3.7.2. NTFS

NTFS is the file system used by Microsoft in the Windows NT range of operating systems (Windows NT, Windows 2000, Windows XP). It is much better designed than FAT was, and supports features like extended attributes and n-fork files.

disktype uses a signature in the "system identifier" field of the boot sector to identify NTFS. I can only hope this really is a signature and not just a coincidence that no one cared to change over the years. disktype also checks some other parameters in the boot sector, but those are shared with the FAT file system family...

Some information on NTFS is available from the Linux-NTFS project at http://linux-ntfs.sourceforge.net/.