The File Allocation Table (FAT) file system architecture was originally designed in 1977 for storing data on floppy disks. The file system capabilities were later extended for use on hard disk drives particular for DOS and later Microsoft Windows systems. The attraction of FAT is its simplicity and robustness, which offers good performance for light-weight storage implementations. It is however, unable to deliver the same level of performance, reliability and scalability of most modern file systems.
Most PC based operating systems, mobile devices, digital cameras and embedded systems support FAT, which means it is still commonly used to exchange between different computer systems and devices. On Windows systems FAT has long since been superseded as the default file system by NTFS. FAT is more suited to removable media (with the exception of CD, DVD and Blu-ray disks) and commonly found on USB sticks, flash cards and other solid-state memory devices. Although FAT is seen as a legacy file system, it is sometimes seen on external hard disk drive. This means that FAT data recovery is still fairly common, usually from removable media.
Features of FAT File System
The original FAT12 file system for floppy disks, used 12 bits values to store the logical cluster numbers for each unit of file allocation. FAT16, introduced in 1984 uses 16 bit logical cluster numbers, allowing its introduction for use on hard disk drives. The introduction of Windows 95, required adding support for Unicode names of up to 255 characters. In 1996, Windows 95 OSR2 introduced FAT32, in which 32 bit values are used to store each logical cluster address.
In the 1980s and 1990s hard drive space was limited and expensive, mean that compression techniques were often made available for use with FAT12 and FAT16 file systems. Such compression utilities are fortunately, now obsolete, which avoids the many complications their used creates during data recovery. The more damage sectors found when such compression techniques were used, the higher the level of file damage which would also be encountered.
Internal Structure of FAT File System
As indicated by the name FAT, the allocation data for all files is stored in a table. Each entry in the FAT indicates whether the cluster is used, bad, the last cluster of a file, or which is the next cluster used, in doing so detailing a chain of used clusters. The late last cluster in a chain used a special value to indicate it is the end of the allocation for the specific file. Most implementation of FAT provided redundancy by using two copies of the file allocation table when storing files on hard disk drives. The latest versions of FAT32 used on hard disk drives and those implemented on larger removable media are often, now implemented using a single FAT.
The metadata for each file is stored in directories, each of which specify the first cluster of the allocation. The FAT is then accessed to determine all the clusters used by the file. The default naming convention on FAT is an uppercase name using the 8.3 format; 8 for the filename, and 3 for the extension. When Unicode support was implemented, the name is split into several directory entries as required. This is often referred to as vFAT, which allows backward compatibility with older operating systems.
Data Recovery From FAT
The simplicity of FAT and the documentation defining the file system, means the results of data recovery, are completely dependent upon the levels of damage to the file system and which areas of the disk have been affected, whether it be due to physical or logical issues. When two copies of the FAT are used, any damage is often recoverable, unless both copies of the same information are damaged, in which case the allocation of some files and directories will be lost. The first cluster of each file is always known, but any fragmentation of the file will result in data loss. Should the directory allocation be lost or corrupt, it will result in files and allocation being lost. The allocation data chain can be recovered using the FAT, but no metadata will be recovered.
In the event of reformatting a FAT volume, the allocation data and the root directory will be reinitialised. It is possible to perform a data recovery through the use an un-format process, whereby directory entries are identified, with file allocation assumed to be contiguous. The quality of any un-format process is dependent upon the level of fragmentation of the files held in the file system. The first cluster of each file located is guaranteed to be correct.