views:

57

answers:

1

Given the following BPB:

FAT32 BPB

The "MSWIN4.1" string is just the "OEM ID" field, and by Microsoft documentation it should not be used to identify FAT volumes.

The "FAT32 " string is the BS_FilSysType field, and by Microsoft documentation it should not be used to identify FAT volumes either.

So how do i identify that the volume is formatted to FAT? Is there any reliable signature I can relay on?

+1  A: 

At position 0x30 of the boot sector will be a pointer to the FSInfoSector - this will start with a signature that should be 41615252h (or, 0x52 0x52 0x61 0x41 / "RRaA")

This should allow you to properly identify to volume - sources: http://www.dewassoc.com/kbase/hard_drives/boot_sector.htm and http://en.wikipedia.org/wiki/File_Allocation_Table#FS_Information_Sector

Lee
Thanks, but the FSInfoSector structure exists only in FAT32 volumes. Is there any signature that can be used to identify FAT12 / FAT16 volumes?
DxCK
Not specifically that I can see myself - from the http://en.wikipedia.org/wiki/File_Allocation_Table#Boot_Sector section you can probably work out a way to check though.
Lee