FATX

FATX is the file system used by the Xbox and the Xbox 360, it is unsupported natively by Windows but has some functionality in Linux.

Partition Locations

Memory Unit

Offset	Length	Information	Format
0x0	0x7FF000	System Cache	STFC (Secure Transacted File Cache)
0x7FF000	end of drive	Data	FATX

Xbox 360 Hard Drive

Offset	Length	Information	Format
0x2000	0x204 - 0x80000	Security Sector	Binary
0x80000	0x80000000	System Cache	STFC (Secure Transacted File Cache)
0x80080000	0xA0E30000	Game Cache	STFC (Secure Transacted File Cache)
0x120eb0000	0x10000000	Xbox 1 Backwards Compatibility	FATX
0x130eb0000	end of drive	Data	FATX

Security Sector

The Security Sector is used by Microsoft to verify that the harddrive is an original Microsoft product. The Security Sector holds details such as drive sector count, drive serial number and the Microsoft logo (to stop other companies using it)

It begins at the 16th sector on the drive (0x2000).

Offset	Length	Type	Information
0x0	0x14	ascii string	Serial Number
0x14	0x8	ascii string	Firmware Revision
0x1C	0x28	ascii string	Model Number
0x44	0x14	bytes	MS Logo Hash
0x58	0x4	unsigned int	Number of Sectors on drive
0x5C	0x100	bytes	RSA Signature
0x200	0x4	signed int	MS Logo Size
0x204	MS Logo Size	image	MS Logo

If a Security Sector from a smaller hard drive is used on a bigger one, the Xbox will only see the number of sectors defined in the Security Sector.

Partition Header

For each offset, add the offset of the partition.

Offset	Length	Type	Information
0x0	0x4	ascii string	Partition magic (XTAF)
0x4	0x4	unsigned int	Partition ID
0x8	0x4	unsigned int	Sectors per Cluster
0xC	0x4	unsigned int	Root directory cluster

Chainmap and directories

To find the offset of the chainmap, take the offset of the position and add 4096 (0x1000) to it. Each entry in the chainmap is either an unsigned int or a unsigned short, depending on the number of clusters inside the partition. To work out the number of clusters, you first have to take the Sectors per Cluster value and multiply it by 512 (0x200), this is the size of the partitions clusters. Now simply divide the partitions size by the cluster size and you have the number of clusters. If the number of clusters is below 65520 (0xFFF0), then the drive uses 2-byte chain entries, otherwise it uses 4 byte chain entries. The size of the chainmap is the size of the chain entries multiplied by the partitions cluster count.