Data Recovery Concept

exFAT Defined Directory Entries

Main exFAT Diectory entries defined in table below:

Defined Directory Entries list
EntryType Primary Critical Code Directory Entry Name
0x81 1 Allocation Bitmap
0x82 2 Up-case Table
0x83 3 Volume Label
0x85 5 File
0xA0 0 Volume GUID
0xA1 1 TexFAT Padding
0xA2 2 Windows CE Access Control Table
0xC0 0 Stream Extension
0xC1 1 File Name

Read about Directory entries below:

Allocation Bitmap Directory Entry

Offset Size Description Comments
0 (0x00) 1 Entry type 0x81
1 (0x01) 1 BitmapFlags (see below) Indicates which Allocation Bitmap the given entry describes
2 (0x02) 18 Reserved  
20 (0x14) 4 First Cluster  
24 (0x18) 8 Data Length  
Bitmap Flags
Bits Size Description Comments
0 1 BitmapIdentifier 0 – 1st bitmap, 1 - 2nd bitmap
1 7 Reserved  

The number of bitmaps and therefore a number of Bitmap Allocation entries is equal to the number of FATs. In case of TexFAT two FATs are used and bit 0 of Flags indicates which bitmap and FAT are referred.

The First Allocation Bitmap shall be used in conjunction with the First FAT and the Second Allocation Bitmap shall be used with the Second FAT. ActiveFat field in Boot Sector defines which FAT and Allocation Bitmap are active.

Bitmap size in bytes must be a number of clusters in the volume divided by 8 and rounded up.

Up-Case Table Directory Entry

Offset Size Description Comments
0 (0x00) 1 Entry type 0x82
1 (0x01) 3 Reserved1  
4 (0x04) 4 TableChecksum Up-case Table checksum
8 (0x08) 12 Reserved2  
20 (0x14) 4 FirstCluster  
24 (0x18) 8 DataLength  

The checksum is calculated against DataLength bytes of Up-case Table according to the following code:

Code:

UINT32 UpCaseTableChecksum(const unsigned char data[], int bytes)
{
	UINT32 checksum = 0;

	for (int i = 0; i < bytes; i++)
		checksum = (checksum << 31) | (checksum >> 1) + data[i];

	return checksum;
}
      

Volume Label Directory Entry

Offset Size Description Comments
0 (0x00) 1 Entry type 0x83
1 (0x01) 1 CharacterCount Length in Unicode characters  (max 11)
2 (0x02) 22 VolumeLabel Unicode string
24 (0x18) 8 Reserved  

If volume is formatted without a label, the Volume Label Entry will be present but Entry Type will be set to 0x03 (not in use).

File Directory Entry

File directory entry describes files and directories. It is a primary critical directory entry and must be immediately followed by 1 Stream Extension directory entry and from 1 to 17 File Name directory entries. Those 3-19 directory entries comprise a directory entry set describing a single file or a directory.

Offset Size Description Comments
0 (0x00) 1 Entry type 0x85
1 (0x01) 1 SecondaryCount Must be from 2 to 18
2 (0x02) 2 SetChecksum  
4 (0x04) 2 FileAttributes (see below)  
6 (0x06) 2 Reserved1  
8 (0x08) 4 CreateTimestamp  
12 (0x0C) 4 LastModifiedTimestamp  
16 (0x10) 4 LastAccessedTimestamp  
20 (0x14) 1 Create10msIncrement 0..199
21 (0x15) 1 LastModified10msIncrement 0..199
22 (0x16) 1 CreateTimezoneOffset Offset from UTC in 15 min increments
23 (0x17) 1 LastModifiedTimezoneOffset Offset from UTC in 15 min increments
24 (0x18) 1 LastAccessedTimezoneOffset Offset from UTC in 15 min increments
25 (0x19) 7 Reserved2  
File Attributes
Bits Size Attribute Comments
0 1 ReadOnly  
1 1 Hidden  
2 1 System  
3 1 Reserved1  
4 1 Directory  
5 1 Archive  
6 10 Reserved2  
Timestamp Format
Bits Size Description Comments
0-4 5 Seconds (as number of 2-second intervals) 0..29 29 represents 58 seconds
5-10 6 Minutes 0..59
11-15 5 Hour 0..23
16-20 5 Day 1..31
21-24 4 Month 1..12
25-31 7 Year (as offset from 1980) 0 represents 1980

Timestamp format records seconds as 2 seconds intervals, so 10ms increments are used to increase precision from 2 seconds to 10 milliseconds. The valid values are from 0 to 199 in 10ms intervals which are added to correspondent timestamp. Timestamp is recorded in local time.

Time zone offset is expressed in 15 minutes increments.

Time Zone Offset Tablet
TimezoneOffset field TZ Offset Time Zone Comments
128 (0x80) UTC Greenwich Standard Time  
132 (0x84) UTC+01:00 Central Europe Time  
136 (0x88) UTC+02:00 Eastern Europe Standard Time  
140 (0x8C) UTC+03:00 Moscow Standard Time  
144 (0x90) UTC+04:00 Arabian Standard Time  
148 (0x94) UTC+05:00 West Asia Standard Time  
152 (0x98) UTC+06:00 Central Asia Standard Time  
156 (0x9C) UTC+07:00 North Asia Standard Time  
160 (0xA0) UTC+08:00 North Asia East Standard Time  
164 (0xA4) UTC+09:00 Tokyo Standard Time  
168 (0xA8) UTC+10:00 West Pacific Standard Time  
172 (0xAC) UTC+11:00 Central Pacific Standard Time  
176 (0xB0) UTC+12:00 New Zealand Standard Time  
180 (0xB4) UTC+13:00 Tonga Standard Time  
208 (0xD0) UTC-12:00 Dateline Standard Time  
212 (0xD4) UTC-11:00 Samoa Standard Time  
216 (0xD8) UTC-10:00 Hawaii Standard Time  
220 (0xDC) UTC-09:00 Alaska Standard Time  
224 (0xE0) UTC-08:00 Pacific Standard Time  
228 (0xE4) UTC-07:00 Mountain Standard Time  
232 (0xE8) UTC-06:00 Central Standard Time  
236 (0xEC) UTC-05:00 Eastern Standard Time  
240 (0xF0) UTC-04:00 Atlantic Standard time  
242 (0xF2) UTC-03:30 Newfoundland Standard Time  
244 (0xF4) UTC-03:00 Greenland Standard Time  
248 (0xF8) UTC-02:00 Mid-Atlantic Standard Time  
252 (0xFC) UTC-01:00 Azores Standard Time  

Volume GUID Directory Entry

In following table presented a benign primary directory entry and may not present in a file system.

Offset Size Description Comments
0 (0x00) 1 EntryType 0xA0
1 (0x01) 1 SecondaryCount Must be 0x00
2 (0x02) 2 SetChecksum  
4 (0x04) 2 GeneralPrimaryFlags (See below)
6 (0x06) 16 VolumeGuid All values are valid except null GUID  {00000000-0000-0000-0000-000000000000}
22 (0x16) 10 Reserved  
Primary Flags Definitions
Bits Size Description Comments
0 1 AllocationPossible Must be 0
1 1 NoFatChain Must be 0
2 14 CustomDefined  

TexFAT Padding Directory Entry

Offset Size Description Comments
0 (0x00) 1 EntryType 0xA1
1 (0x01) 31 Reserved  

exFAT 1.00 does not define TexFAT Padding directory entry. TexFAT Padding directory entries are only valid in the first cluster of directory and occupy every directory entry of the cluster. The implementations should not move TexFAT Padding directory entries.

Windows CE Access Control Table Directory Entry

Offset Size Description Comments
0 (0x00) 1 EntryType 0xA2
1 (0x01) 31 Reserved  

exFAT 1.00 does not define Windows CE Access Control Table Directory Entry.

Stream Extension Directory Entry

Offset Size Description Comments
0 (0x00) 1 EntryType 0xC0
1 (0x01) 1 GeneralSecondaryFlags (see below)
2 (0x02) 1 Reserved1  
3 (0x03) 1 NameLength Length of Unicode name contained in subsequent File Name directory entries
4 (0x04) 2 NameHash Hash of up-cased file name
6 (0x06) 2 Reserved2  
8 (0x08) 8 ValidDataLength Must be between 0 and DataLength
16 (0x10) 4 Reserved3  
20 (0x14) 4 FirstCluster  
24 (0x18) 8 DataLength For directories maximum 256 MB
Secondary Flags Definitions
Bits Size Description Comments
0 1 AllocationPossible Must be 1
1 1 NoFatChain  
2 14 CustomDefined  

Stream Extension directory entry must immediately follow the File directory entry in the set. It could be only one Stream Extension entry in the set. If NoFatChain flag is set, all allocated clusters are contiguous.

The NameHash field facilitates the purpose of fast file name comparison and is performed on up-cased file name. NameHash verify against a mismatch, however matching hashes cannot guarantee the equality of file names. If name hashes match, a subsequent full name comparison must be performed.

Code:

  // fileName points to up-cased file name
  UINT16 NameHash(WCHAR *fileName, int nameLength)
  {
    UINT16 hash = 0;
    unsigned char *data = (unsigned char *)fileName;

    for (int i = 0; i < nameLength * 2; i++)
      hash = (hash << 15) | (hash >> 1) + data[i];
    
    return hash;
  }     
      

ValidDataLength determines how much actual data written to the file. Implementation shall update this field as data has been written. The data beyond the valid data length is undefined and implementation shall return zeros.

File Name Directory Entry

Offset Size Description Comments
0 (0x00) 1 EntryType 0xC1
1 (0x01) 1 GeneralSecondaryFlags (see below)  
2 (0x02) 30 FileName  
Secondary Flags Definitions
Bits Size Description Comments
0 1 AllocationPossible Must be 0
1 1 NoFatChain Must be 0
2 14 CustomDefined  

File Name directory entries must immediately follow the Steam Extension directory entry in the number of NameLength/15 rounded up. The maximum number of File Name entries is 17, each can hold up to 15 Unicode characters and the maximum file name length is 255. Unused portion of FileName field must be set to 0x0000.

Invalid File Name Characters
Character Code Character Description
0x0000 – 0x001F   Control codes
0x0022 Quotation mark
0x002A * Asterisk
0x002F / Forward slash
0x003A : Colon
0x003C Less than
0x003E Greater than
0x003F ? Question mark
0x005C \ Back slash
0x007C | Vertical bar
Active@ UNDELETEDownload NowBuy Now
Intel Software PartnerWindows 7 Compatible