3.1 The Header

Byte offset

Field name

Field value

0x0000

Header Signature

0xE11AB1A1E011CFD0

0x0008

Header CLSID

0x00000000000000000000000000000000 (null)

0x0018

Minor Version

0x003E

0x001A

Major Version

0x0003

0x001C

Byte Order

0xFFFE

0x001E

Sector Size

0x0009 (512 bytes per sector)

0x0020

Mini Stream Sector Size

0x0006 (64 bytes per Mini Stream sector)

0x0022

Reserved

0x0000 0x00000000

0x0028

Number of directory Sector

0x00000000 (not used for version 3)

0x002C

Number of FAT sectors

0x00000001 (1 FAT sector)

0x0030

Directory Starting Sector Location

0x00000001 (sector #1 for Directory)

0x0034

Transaction Signature

0x00000000 (not used)

0x0038

Mini Stream Size Cutoff

0x00001000 (4,096 bytes)

0x003C

Mini FAT Starting Sector Location

0x00000002 (sector #2 for Mini FAT)

0x0040

Number of Mini FAT sectors

0x00000001 (1 Mini FAT sector)

0x0044

DIFAT Start Sector Location

0xFFFFFFFE (ENDOFCHAIN)

0x0048

Number of DIFAT Sectors

0x00000000 (no DIFAT, less than 7 MB)

0x004C

DIFAT[0]

0x00000000 (sector #0 for FAT)

0x0050

DIFAT[1] through DIFAT[108]

0xFFFFFFFF (FREESECT) (free FAT sectors)

000000: D0CF 11E0 A1B1 1AE1 0000 0000 0000 0000 ................

 000010: 0000 0000 0000 0000 3E00 0300 FEFF 0900 ........;.......
 000020: 0600 0000 0000 0000 0000 0000 0100 0000 ................
 000030: 0100 0000 0000 0000 0010 0000 0200 0000 ................
 000040: 0100 0000 FEFF FFFF 0000 0000 0000 0000 ................
 000050: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000060: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000070: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000080: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000090: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000A0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000B0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000C0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000D0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000E0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0000F0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000100: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000110: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000120: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000130: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000140: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000150: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000160: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000170: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000180: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 000190: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001A0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001B0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001C0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001D0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001E0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................
 0001F0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF ................