1

I format my flash memory and select its file system format as FAT32 :

enter image description here

And then take a look at the flash memory drive properties :

enter image description here

As you see above, there is a 16KB used space.

I change windows options to show all the hidden files and system files:

enter image description here

And take a look at the contents of the flash memory. As you see it is empty :

enter image description here

To be ensure, I also list its contents with Command-line :

I:\>dir /A
 Volume in drive I is TRANSCEND
 Volume Serial Number is 7E4F-5898

 Directory of I:\

File Not Found

I:\>

As you see above, it's empty!

For your information :

/A in the command line, indicate to show all the file (hidden files, system files , ...)

I:\>dir /?
Displays a list of files and subdirectories in a directory.

DIR [drive:][path][filename] [/A[[:]attributes]] [/B] [/C] [/D] [/L] [/N]
  [/O[[:]sortorder]] [/P] [/Q] [/R] [/S] [/T[[:]timefield]] [/W] [/X] [/4]

  [drive:][path][filename]
              Specifies drive, directory, and/or files to list.

  /A          Displays files with specified attributes.
  attributes   D  Directories                R  Read-only files
               H  Hidden files               A  Files ready for archiving
               S  System files               I  Not content indexed files
               L  Reparse Points             -  Prefix meaning not
  /B          Uses bare format (no heading information or summary).
  /C          Display the thousand separator in file sizes.  This is the
              default.  Use /-C to disable display of separator.
  /D          Same as wide but files are list sorted by column.
  /L          Uses lowercase.
  /N          New long list format where filenames are on the far right.
  /O          List by files in sorted order.
  sortorder    N  By name (alphabetic)       S  By size (smallest first)
               E  By extension (alphabetic)  D  By date/time (oldest first)
               G  Group directories first    -  Prefix to reverse order
  /P          Pauses after each screenful of information.
  /Q          Display the owner of the file.
  /R          Display alternate data streams of the file.
  /S          Displays files in specified directory and all subdirectories.
  /T          Controls which time field displayed or used for sorting
  timefield   C  Creation
              A  Last Access
              W  Last Written
  /W          Uses wide list format.
  /X          This displays the short names generated for non-8dot3 file
              names.  The format is that of /N with the short name inserted
              before the long name. If no short name is present, blanks are
              displayed in its place.
  /4          Displays four-digit years

Switches may be preset in the DIRCMD environment variable.  Override
preset switches by prefixing any switch with - (hyphen)--for example, /-W.

This problem become more funny when I format the flash memory with NTFS as its file system format :

enter image description here

As you see below, it this case, I lose 125MB of my flash memory space :

enter image description here

All the other steps that I did for FAT32, make the same output for NTFS

Q1: What's the problem? where the origin of this occupied space?

Q2: Can I see those file[s] that use the space?

Just to have more fun, I mount this flash (with formatted with NTFS) in Linux and take a look at it :

enter image description here

It is so weird! we have 87.2MB used space! (While it was 125MB in windows7).

And let take a look at its contents via ls -a command:

enter image description here

Oh! Nothing again!

Q3: Why used space is different for a single flash in two OS?

Update: For FAT32 format, both Windows and Linux [BackTrack in this case], there is no difference and in both we have 16KB.

Appreciate your time and consideration.

TheGoodUser
  • 1,195

1 Answers1

1

Regarding FAT32

TL;DR;

File size is calculated by counting free entries of the File Allocation Table, FAT can NOT be empty because of required root directory entry, therefore FAT filesystem always needs one cluster of space (= Allocation unit size)!

Detailed answer

The FAT32 filesystem works in clusters, that is the Allocation size unit you selected. FAT32 by design needs one cluster per file + one cluster for the root directory.

The FAT32 file system contains following parts:

FAT32 file system

[From Paul's 8051 Code Library: Understanding FAT32 Filesystems]

The clusters area is divided into clusters of same size, e.g. 4k, 8k, 16k and 32k. Each file including the root directory take one or more clusters:

  1. The Volume ID specifies the cluster where the root directory STARTS, which is typically the third cluster, cluster 2 when counting from 0. (0x02C)

  2. The root directoy cluster contains directory entries, these are 32 bytes structures which give information about files AND directories, most importantly

    • name
    • kind of file (file or directory)
    • 1. cluster of the file/directoy
    • size of the file/directory.

    Directory entry

    [From Paul's 8051 Code Library: Understanding FAT32 Filesystems]

  3. To KNOW how many clusters we need to read for files and directory including the root directory we need to read of FAT #1 or FAT #2 which are File Allocation Tables:

    • Both FATs contain the same data for redundancy.
    • The FAT contains one entry for each data cluster.
    • Each entry is 32 bit long (hence FAT32),
    • A 32 bit FAT entry specifies either
      • the number of the next cluster for a file/directory,
      • that this is the last cluster (0xFFFFFFFF) of the file/directory,
      • that this cluster is empty (0x0).
|3: 0x5                           |4: 0x6                           |5: 0xFFFFFFF       |6: 0xFFFFFFF        |7: 0x          |8: 0x0 | ...
| 1. file start, next cluster 0x4 | 2. file start, next cluster 0x7 | 1. file ends here | 2. files ends here | Empty cluster | Empty | ...

So to read a file/directory, we

  1. Read the starting sector and file size from the directory entry.
  2. Find out subsequent sectors from FAT.
  3. Read sectors in right order for size bytes.

FOR AN EMPTY FAT FILESYSTEM the FAT contains ONE entry at sector 2 for the root directory, specifying that this sector is the last one:

# for i in `seq 0 3`; do (fatcat -@ $i /dev/sda1 | grep FAT1); done
#     fatcat => FAT filesystem explore, extract, repair, and forensic tool
#         -@ <cluster> => display cluster info: offset, address, FAT entry
FAT1: 4294967295 (ffffffff) # sec 0
FAT1: 4294967295 (ffffffff) # sec 1
FAT1: 4294967295 (ffffffff) # sec 2, 1. and last sector for the root directory.
FAT1: 0 (00000000)          # sec 3, empty because there are no more files/directories.

For linux systems, commands like df, stat use the statfs system call, which calculates the used space of a FAT32 filesystem by reading all non-0x0 FAT entries:

int fat_count_free_clusters(struct super_block *sb)
{
    ...

free = 0;
fatent_init(&amp;fatent);
fatent_set_entry(&amp;fatent, FAT_START_ENT);
fat_ra_init(sb, &amp;fatent_ra, &amp;fatent, sbi-&gt;max_cluster);
while (fatent.entry &lt; sbi-&gt;max_cluster) {
    /* readahead of fat blocks */
    fat_ent_reada(sb, &amp;fatent_ra, &amp;fatent);

    err = fat_ent_read_block(sb, &amp;fatent);
    if (err)
        goto out;

    do {
        // WHEN FAT entry == 0x0 this entry is free space!
        if (ops-&gt;ent_get(&amp;fatent) == FAT_ENT_FREE) 
            free++;
    } while (fat_ent_next(sbi, &amp;fatent));
    cond_resched();
}
sbi-&gt;free_clusters = free;

...



}

fs/fat/fatent.c#L714 of linux kernel v5.13

Because your Allocation unit size (= cluster size) is 16kB, 16kB are already used for the one root directory FAT entry (3. entry, 0xFFFFFFFF).

goulashsoup
  • 155