Exploring HP's FAT Filesystem
Written 2011-10-22
Tags:HPFAT Printer HP driver FAT File system filesystem
When high end HP printers receive a document, they may spool it to a hard disk temporarily. These drives use HP's own implementation of a FAT filesystem. The vendor string is "HpFAT1.0". I've identified the directory entry structure, and a few members inside of it. It goes a little something like this:
typedef packed struct
{
char filename[100];
uint16 some_interesting_value;
uint8 always_null_so_far_a[15];
uint8 attribyte;
uint8 always_null_so_far_b[3];
uint8 always_0x88_so_far;
uint16 start_of_file_in_clusters;
uint32 filesize;
};
I think the filename can be up to 100 characters, including period and extension. The attributes appear to be the same as FAT16, as do the last six bytes of the entry.
I have an example filesystem pulled from a printer, and can retrieve some files, but don't know what they mean. There are some 'MDT' files, 'MNF' files, and a '.DB' file. I should write a parser, and either extend the Linux kernel module for msdos to handle HPFAT, or copy and modify it into a new driver.
Some Numbers:
Deletion marker: 0xE5
Bytes/sector: 512
Sectors/cluster: 63
Reserved clusters: 13
Copies of FAT: 1
Max Dirents: 64
Type:0xF8-fixed disk
Sectors/FAT: 0xFB
Sectors/Track: 0x3F
Heads: 0x10
Hidden sector count: 0x0