DiskSalvor › Help

Inside FAT32 and exFAT

How drives work · How FAT32 and exFAT store folders and file chains, what deleting changes, and which deleted files come back whole.

boot+ backup FAT 1 FAT 2(FAT32 copy) data area: clusters 2, 3, 4 … (folders are files too: lists of 32-byte entries) Layout How one file is found folder entry"beach.jpg", 45 KB, starts at cluster 5 FAT[5]→ 6FAT[6]→ 9FAT[9]end The FAT is a chain: each cluster numbersays which cluster comes next.

Folders are just files containing a list of 32-byte entries (name, size, dates, first cluster). Long names are stored in extra entries in front of the short one.

Deleting on FAT32 replaces the name's first letter and sets its chain to 0. The start cluster survives, so unfragmented files come back whole; fragmented ones only partly. exFAT keeps a "stored in one piece" flag per file and a bitmap of used clusters, so deleted files there are often fully recoverable.

Backups: FAT32's boot sector is copied at sector 6 and the FAT is usually stored twice. exFAT's boot region (sectors 0–11) has a checksum and a full copy at sectors 12–23, but usually only one FAT.

← PreviousInside NTFSNext →What Windows does when you plug in a drive

Free help for a failing drive

DiskSalvor is free, open-source data recovery for failing drives on Windows. It never writes to the drive, gets the easy files off first, goes back for the rest round by round, and explains what it's doing in plain English. No file limits, no paid edition, no account.

Start here if your drive is failing

How drives work

Reference