How disk cluster size affects data recovery processes

But before we talk disk clusters, I want to mention that Norton Disk Editor treats the FAT and FAT-32 file systems very differently from the NTFS file system. When working with FAT or FAT-32 file systems, you have the luxury of being able to view the file allocation table directly through Disk Editor. But Disk Editor does not allow you to view the file allocation table (in directory format) for NTFS volumes unless the volume was originally created in FAT or FAT-32 format and then converted to NTFS.

Since my goal in this article is to teach you some basics, I'll focus only on FAT and FAT-32. (I will show you how to apply what you have learned to NTFS in a later article.)

Although it may look intimidating, the Disk Editor interface itself is fairly simple. But to make good use of it, you need to understand something about how the file system makes use of the physical disk.

What is a disk cluster?

A disk cluster is the smallest unit of space that you can allocate on a disk. But don't think of a cluster as being able to hold one byte of data; a cluster's size varies depending on the disk's size and format.

Think of a disk cluster as a non-divisible block of space. When you save a file, that file is placed into clusters. If a file is larger than the hard disk's cluster size, the file will span multiple clusters (sometimes referred to as a cluster chain). But a file often does not use all the space in the chain's last cluster. When this happens, the remaining space in that cluster is wasted. A cluster cannot be shared by multiple files.

Why a disk cluster's size depends on the hard disk's size and file system

Why does a cluster's size vary depending on the hard disk's size and file system? To see why, let's look at the FAT file system. As a 16-bit file system, it is limited to using a maximum of 65,536 clusters.

Because the hard disk is limited to using a fixed number of clusters, the disk cluster size must change depending on the capacity of the partition. To calculate the disk cluster size, take the size of the partition and divide it among the number of available clusters. For example, the maximum size of a FAT-16 partition is 2 GB.

How to calculate a disk cluster size

How do we calculate the cluster size for a 2 GB partition? First, we take 1024 (the number of bytes in a kilobyte) and multiply it by 1024; this will give us the number of bytes in a megabyte. Multiplying that result by 1024 again will give us the number of bytes in a gigabyte.

Multiply that number by two (since the maximum partition size for a FAT file system is 2 GB). Now divide that number by 65,536 (the total number of clusters in the partition) and that will give us the cluster size (in bytes). But since cluster sizes are usually reported in kilobytes, divide the result by 1024. You will see that the cluster size for the partition is 32 KB.

Here's a breakdown of the math:

2 to the 16th power = 65536 (total clusters)
1024 (one KB) x 1024 = 1048576 (one MB)
1048576 (one MB) x 1024 = 1073741824 (one GB)
1073741824 (one GB) x 2 = 2147483648 (two GB)
2147483648 (two GB) / 65536 (total clusters) = 32768 (bytes per cluster)
32768 (bytes per cluster) / 1024 (1 KB) = 32 (KB cluster size)
However, the number of clusters varies depending on the size of the partition. Here is the cluster size used by various partition sizes.

For a drive size of 256 MB to 511 MB, the cluster size is 8 KB. For a drive size of 512 MB to 1023 MB, the cluster size is 16 KB. For a drive size of 1024 MB to 2 GB, the cluster size is 32 KB.

Notice that a FAT partition uses 32 KB clusters for any partition from 1 GB to 2 GB. If a 1 GB partition uses the same number cluster size as a 2 GB partition, it means that the 1 GB partition will contain half as many clusters as the 2 GB partition.

The smaller you make the partition, the smaller the cluster size. The smaller the cluster size, the less wasted space when a partial cluster is used. Suppose you're limited to using the FAT-16 file system and you have a 1 GB hard disk. (Not that anyone uses a 1 GB hard disk any more, but it makes the math easy and the concept is the same for larger drives). Let's take the worst possible situation and fill the drive with 1-byte files.

Even a 1-byte file occupies an entire cluster, which is 32 KB in this case. This means that each of the 32768 clusters is wasting 32767 bytes. Which means that a total of 1073709056 bytes are wasted, for a total waste of approximately 1023.96 KB of the 1024 KB!

Granted, hardly anyone uses the FAT file system any more because it limits you to using a 2 GB partition, which, by today's standards, is ridiculously small. But I wanted to demonstrate the cluster size concept with the FAT file system because the numbers are small, which makes the math easier.

The same concept applies to the FAT-32 file system; the only difference is that the FAT-32 file system is a 32-bit file system. This means that FAT-32 supports the use of a greater number of clusters, and consequently larger partitions. In fact, a FAT-32 file system can have a maximum of 4,294,967,296 clusters. The table below shows how FAT-32 compares to FAT.

Partition Size	FAT Cluster Size	FAT-32 Cluster Size
265 MB – 511 MB	8 KB	Not Supported
512 MB – 1023 MB	16 KB	4 KB
1024 – 2 GB	32 KB	4 KB
2 GB – 8 GB	Not Supported	4 KB
8 GB – 16 GB	Not Supported	8 KB
16 GB – 32 GB	Not Supported	16 KB
>32 GB	Not Supported	32 KB

Table: FAT vs. FAT-32

Not only does FAT-32 support larger partitions than FAT, but on smaller partitions, the increased number of clusters means the disk cluster size is smaller. The smaller a partition's cluster size, the less wasted space on the drive.

For example, on a 2 GB partition, the size of a FAT cluster is 32 KB. If a file is 33 KB in size, it would consume two clusters, meaning that 31 KB of space goes to waste. This doesn't sound like much, but consider that every file on the entire partition could potentially waste this much space. In contrast, a 2 GB FAT-32 partition uses 4 KB clusters. The same 33 KB file would consume nine clusters instead of two, but the clusters are smaller. The end result is that only 3 KB of space would go to waste, not 31 KB.

What does all this have to do with data recovery? Everything! If a partition's file allocation table is damaged and you need to recover a file, the first thing you will need to determine is how many clusters the file in question spans. This is important because you need to be able to figure out where a file begins and where it ends.

If you know the disk cluster size that is in use, you can just divide the file size by the cluster size to get the total number of clusters that are in use (be sure to round up to the nearest whole cluster).

Calculating disk cluster size: A shortcut

If you're having trouble calculating cluster size, here's a shortcut. If you run CHKDSK against the volume that you are trying to recover (don't use the /F switch), one of the pieces of information that CHKDSK will give you is the number of bytes in each allocation unit. An allocation unit and a cluster are the exact same thing. Therefore the number of bytes in each allocation unit is the disk cluster size.

About the author: Brien M. Posey, MCSE, is a Microsoft Most Valuable Professional for his work with Windows 2000 Server, Exchange Server and IIS. He has served as CIO for a nationwide chain of hospitals and was once in charge of IT security for Fort Knox. He writes regularly for SearchWinComputing.com and other TechTarget sites.