First, note that the data shown below is from the beginning of a FAT32 file system's FAT (File Allocation Table); which is used by the Windows 95'B'(OSR2), Windows 98/Win98SE and WinME OSs, and will also be used by Windows 2000 or Windows XP when they access a FAT32 volume.
When operating under real (16-bit)
DOS 7.1 (the Windows 98/98SE Boot Disk) or at any time before one of the
Windows Operating Systems has loaded itself into Memory (using the F8 key,
for example, to select Command Prompt only), the 8th byte (sector
offset 007) of a 32-bit FAT's first sector should be a
0Fh (or an FFh). Under the Windows
OSs listed above, it appears (from disk editor observations I've made) that
Microsoft uses the 0Fh byte only for the volume that
contains the running Operating System, and the FFh byte for any other volume that it is accessing.
as seen in this
example partial disk editor view of the FAT's first sector:
Once Windows starts booting up, the eigth byte is
changed to a 07h (or
an F7h *) which will
be set back to a 0Fh
(or FFh) only if
Windows is properly shut down. If there's a power failure, or the
system's Power switch is accidentally turned OFF or the system must be
manually rebooted because the Windows OS gets 'locked up' (crashes)
due to some software problem, then this byte will remain a
07h (or F7h) which tells the Windows
OS (next time it is booted) that there was some kind of improper shut down!
If the system had been in the process of downloading a file from the Net or
writing to the hard drive for any reason, then it's likely one or more
errors will exist in the file structure of the drive, so Windows immediately
runs ScanDisk when it sees that it wasn't shut down correctly the last
If for some reason you wish to temporarily keep Windows from automatically running ScanDisk after a crash, Windows 98 has a selection in its System Configuration program for doing so; in Windows 95, the line AutoScan=0 must be added to the Hidden, System file, MSDOS.SYS.
The following information is taken from page 17 of the work, FAT:
General Overview of On-Disk Format ( Version 1.02, May 5, 1999)
A Hardware White Paper by Microsoft Corporation. (PDF Format) It has been
slightly revised and edited for the format of this web page.
" What are the two reserved cluster [fields] at the start of the FAT for ? "
The first reserved cluster, FAT, contains the BPB_Media byte value in its low 8 bits, and all other bits are set to 1. For example, if the BPB_Media value is 0xF8, then
for FAT16, FAT = 0xFFF8, and [F8FF on disk.]
for FAT32, FAT = 0x0FFFFFF8. [F8FFFF0F on disk.]
(or: FAT32, FAT = 0xFFFFFFF8. [F8FFFFFF on disk.])
The second reserved cluster, FAT, is set by FORMAT to the EOC mark. On FAT12 volumes, it is not used and simply always contains an EOC mark. For FAT16 and FAT32, the file system driver may use the high two bits of the FAT entry for dirty volume flags (all other bits, are always left set to 1). Note that the bit location is different for FAT16 and FAT32, because they are the high 2 bits of the entry. [This is a very poor way to state the differences here!]
ClnShutBitMask = 0x8000;
HrdErrBitMask = 0x4000;
ClnShutBitMask = 0x08000000;
HrdErrBitMask = 0x04000000;
Mask- If bit is 1, volume is "clean". If bit is 0, volume is "dirty". This indicates that the file system driver did not dismount the volume properly the last time it had the volume mounted. It would be a good idea to run a Chkdsk/Scandisk disk repair utility on it, because it may be damaged. [ FAT32 Example: 0xFFFFFFFF XOR 0x08000000 = 0xF7FFFFFF 1111 0111 = F7h | + --- This is the 'ClnShutBit'] Bit HrdErrBit Mask- If this bit is 1, no disk read/write errors were encountered. If this bit is 0, the file system driver encountered a disk I/O error on the Volume the last time it was mounted, which is an indicator that some sectors may have gone bad on the volume. It would be a good idea to run a Chkdsk/Scandisk disk repair utility that does surface analysis on it to look for new bad sectors. [ FAT32 Example: 0xFFFFFFFF XOR 0x04000000 = 0xFBFFFFFF 1111 1011 = FBh | + --- This is the 'HrdErrBit']