In my class we are discussing the FAT partition table and the BIOS Perimeter Block (BPB). For our introduction to it we had to manually process the BPB/MBR and determine a few things, such as the number of bytes per sector, how many sectors per cluster, and determining if the FAT is FAT12, FAT16, or FAT32.
While not a difficult thing to do using forensics tools, there may instances where portions of the FAT may be corrupted and a manual decode would be necessary. For our purposes, we were given the data structure which provided the bytes, length, and what it represents. However, in practice counting each byte group and trying to keep track of your position can be quite bothersome. To alleviate this problem I turned the position in bytes into its hex offset (0x0D for example). I did this because the hex editor we are using is gHex for Linux and it displays the offset of the byte(s) you’ve selected. I wanted to share this with you, and hope it helps.
The following table information was obtained from “File System Forensic Analysis, Brian Carrier, Addison-Wesley” chapter 10. My contribution to this data is the hex offset, the rest belongs to the author.
|Byte Range||Hex Offset||Description||Essential (Y/N)|
|0 - 2||0x00 - 0x02||Assembly instruction to jump to boot code.||No (unless it is a bootable file system)|
|3 - 10||0x03 - 0x0A||OEM Name in ASCII.||No|
|11 - 12||0x0B - 0x0C||Bytes per sector. Allowed values include 512, 1024, 2048, and 4096.||Yes|
|13||0x0D||Sectors per cluster (data unit). Allowed values are powers of 2, but the cluster size must be 32KB or smaller.||Yes|
|14 - 15||0x0E - 0x0F||Size in sectors of the reserved area.||Yes|
|16||0x10||Number of FATs. Typically two for redundancy, but according to Microsoft it can be one for some small storage devices.||Yes|
|17 - 18||0x11 - 0x12||Maximum number of files in the root directory for FAT12 and FAT16. This is 0 for FAT32 and typically 512 for FAT16.||Yes|
|19 - 20||0x13 - 0x14||16-bit value of number of sectors in file system. If the number of sectors is larger than can be represented in this 2-byte value, a 4-byte value exists later in the data structure and this should be 0.||Yes|
|21||0x15||Media type. According to the Microsoft documentation, 0xf8 should be used for fixed disks and 0xf0 for removable.||No|
|22 - 23||0x16 - 0x17||16-bit size in sectors of each FAT for FAT12 and FAT16. For FAT32, this field is 0.||Yes|
|24 - 25||0x18 - 0x19||Sectors per track of storage device.||No|
|26 - 27||0x1A - 0x1B||Number of heads in storage device.||No|
|28 - 31||0x1C - 0x1F||Number of sectors before the start of partition.||No|
|32 - 35||0x20 - 0x23||32-bit value of number of sectors in file system. Either this value or the 16-bit value above must be 0.||Yes|
Book author’s note:
 My testing has shown that for file systems in an extended partition, Windows sets this value based on the beginning of the extended partition, not the beginning of the disk.