I was going through this link: FAT16 Basics to Assemble Clusters. I have read the structures involved in defining a directory entry in FAT. Now when giving the example for a FAT16 File, it says the data cluster is 0x03 for the example file MyFile.txt. Which means if we logically compute the Data Cluster we will be able to reach to the first node which happens to be cluster no 3.
But what I fail to understand is what the author is trying to say in the next line where it says
What we can see in the File Allocation Table at this moment?
How suddenly we reach to the File Allocation Table? Weren’t we already there when we were going through the information of Myfile.txt? I couldn’t find any reason how suddenly the author jumped to an offset location of 00000200 and is identifying the emptiness of the clusters. It will be great if someone can help me understand.
The author tells you in the bullet points just below.
But the FAT starts at offset 0x0200, and since the file starts in the 3rd cluster and FAT16 cluster are two bytes (16 bits) in size, you start at offset 2 × 3, or 6.
On the drive, the allocated size is 32K, and the file size is > 32K × 3 but <= 32K × 4, the file will take four clusters, so the educated guess here during file recovery is that the eight bytes starting at offset six contain the four cluster numbers of the file.