1

Given the following BPB:

FAT32 BPB http://img121.imageshack.us/img121/1131/fat32bpb.png

The "MSWIN4.1" string is just the "OEM ID" field, and by Microsoft documentation it should not be used to identify FAT volumes.

The "FAT32 " string is the BS_FilSysType field, and by Microsoft documentation it should not be used to identify FAT volumes either.

So how do i identify that the volume is formatted to FAT? Is there any reliable signature I can relay on?

DxCK
  • 4,402
  • 7
  • 50
  • 89

1 Answers1

1

At position 0x30 of the boot sector will be a pointer to the FSInfoSector - this will start with a signature that should be 41615252h (or, 0x52 0x52 0x61 0x41 / "RRaA")

This should allow you to properly identify to volume - sources: http://www.dewassoc.com/kbase/hard_drives/boot_sector.htm and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector

Lee
  • 2,204
  • 13
  • 15
  • Thanks, but the FSInfoSector structure exists only in FAT32 volumes. Is there any signature that can be used to identify FAT12 / FAT16 volumes? – DxCK Mar 13 '10 at 10:07
  • Not specifically that I can see myself - from the http://en.wikipedia.org/wiki/File_Allocation_Table#Boot_Sector section you can probably work out a way to check though. – Lee Mar 13 '10 at 15:45