Sponsoring website: Emergency Boot Kit

 

Detailed Notes on the
"Dirty Shutdown Flag"
under MS-Windows™


    First, note that the data shown below is from the beginning of a FAT32 file system's FAT (File Allocation Table); which is used by the Windows 95'B'(OSR2), Windows 98/Win98SE and WinME OSs, and will also be used by Windows 2000 or Windows XP when they access a FAT32 volume.

    When operating under real (16-bit) DOS 7.1 (the Windows 98/98SE Boot Disk) or at any time before one of the Windows Operating Systems has loaded itself into Memory (using the F8 key, for example, to select Command Prompt only), the 8th byte (sector offset 007) of a 32-bit FAT's first sector should be a 0Fh (or an FFh). Under the Windows OSs listed above, it appears (from disk editor observations I've made) that Microsoft uses the 0Fh byte only for the volume that contains the running Operating System, and the FFh byte for any other volume that it is accessing. as seen in this example partial disk editor view of the FAT's first sector: 

Absolute sector 95 (cylinder 0, head 1, Sector 33 )
        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
0000:  F8 FF FF 0F FF FF FF 0F 03 00 00 00 04 00 00 00
0010:  FF FF FF 0F 06 00 00 00 07 00 00 00 08 00 00 00
0020:  09 00 00 00 0A 00 00 00 0B 00 00 00 0C 00 00 00

 Your FAT might look like this instead:

Absolute sector 95 (cylinder 0, head 1, Sector 33 )
        0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
0000:  F8 FF FF FF FF FF FF FF 03 00 00 00 04 00 00 00
0010:  FF FF FF 0F 06 00 00 00 07 00 00 00 08 00 00 00
0020:  09 00 00 00 0A 00 00 00 0B 00 00 00 0C 00 00 00

(Note: Only the first 8 bytes are important for this discussion!)
Once Windows starts booting up, the eigth byte is changed to a 07h (or an F7h *) which will be set back to a 0Fh (or FFh) only if  Windows is properly shut down. If there's a power failure, or the system's Power switch is accidentally turned OFF or the system must be manually rebooted because the Windows OS gets 'locked up' (crashes) due to some software problem, then this byte will remain a 07h (or F7h) which tells the Windows OS (next time it is booted) that there was some kind of improper shut down! If the system had been in the process of downloading a file from the Net or writing to the hard drive for any reason, then it's likely one or more errors will exist in the file structure of the drive, so Windows immediately runs ScanDisk when it sees that it wasn't shut down correctly the last time.

    If for some reason you wish to temporarily keep Windows from automatically running ScanDisk after a crash, Windows 98 has a selection in its System Configuration program for doing so; in Windows 95, the line AutoScan=0 must be added to the Hidden, System file, MSDOS.SYS.

References

The following information is taken from page 17 of the work, FAT: General Overview of On-Disk Format ( Version 1.02, May 5, 1999) A Hardware White Paper by Microsoft Corporation. (PDF Format) It has been slightly revised and edited for the format of this web page.

    " What are the two reserved cluster [fields] at the start of the FAT for ? "
    The first reserved cluster, FAT[0], contains the BPB_Media byte value in its low 8 bits, and all other bits are set to 1. For example, if  the BPB_Media value is 0xF8, then

 for FAT16, FAT[0] = 0xFFF8, and  [F8FF on disk.]
 for FAT32, FAT[0] = 0x0FFFFFF8.  [F8FFFF0F on disk.]
(or: FAT32, FAT[0] = 0xFFFFFFF8.  [F8FFFFFF on disk.])


 The second reserved cluster, FAT[1], is set by FORMAT to the EOC mark. On FAT12 volumes, it is not used and simply always contains an EOC mark. For FAT16 and FAT32, the file system driver may use the high two bits of the FAT[1] entry for dirty volume flags (all other bits, are always left set to 1). Note that the bit location is different for FAT16 and FAT32, because they are the high 2 bits of the entry. [This is a very poor way to state the differences here!]

For FAT16:

For FAT32:

Bit ClnShutBitMask - If bit is 1, volume is "clean".
                     If bit is 0, volume is "dirty". This indicates that
    the file system driver did not dismount the volume properly the last
    time it had the volume mounted. It would be a good idea to run a
    Chkdsk/Scandisk disk repair utility on it, because it may be damaged.

[ FAT32 Example: 0xFFFFFFFF XOR 0x08000000 = 0xF7FFFFFF
                            1111 0111 = F7h
                           |
                           + --- This is the 'ClnShutBit']


Bit HrdErrBitMask - If this bit is 1, no disk read/write errors were
                    encountered.
                    If this bit is 0, the file system driver encountered a
    disk I/O error on the Volume the last time it was mounted, which is an
    indicator that some sectors may have gone bad on the volume. It would
    be a good idea to run a Chkdsk/Scandisk disk repair utility that does
    surface analysis on it to look for new bad sectors.

[ FAT32 Example: 0xFFFFFFFF XOR 0x04000000 = 0xFBFFFFFF
                            1111 1011 = FBh
                             |
                             + --- This is the 'HrdErrBit']

Notes


* It appears that some utility programmers (perhaps even some at Microsoft?!) were misguided into making the wrong assumptions about the words highlighted above (in yellow) from the original Microsoft White Paper. Elsewhere in this same paper (page 15), the author informs us that:

"A FAT32 FAT entry is actually only a 28-bit entry. The high 4 bits of a FAT32 FAT entry are reserved. The only time that the high 4 bits of FAT32 FAT entries should ever be changed is when the volume is formatted, at which time the whole 32-bit FAT entry should be zeroed, including the high 4 bits.
  A bit more explanation is in order here, because this point about FAT32 FAT entries seems to cause a great deal of confusion."

Well, it might not have if the author had also mentioned this fact when commenting on the FAT32's FAT signature bytes!

Last Update: 4 DEC 2001.


  "The Starman's Realm" Index Page

  "The Starman's Realm" Assembly Page

  "The Starman's Realm" MBR Page