FATX
FATX is the file system used by the Xbox and the Xbox 360, it is unsupported natively by Windows but has some functionality in Linux.
Partition Locations
Memory Unit
| Offset | Length | Information | Format |
|---|---|---|---|
| 0x0 | 0x7FF000 | System Cache | STFC (Secure Transacted File Cache) |
| 0x7FF000 | end of drive | Data | FATX |
Xbox 360 Hard Drive
| Offset | Length | Information | Format |
|---|---|---|---|
| 0x2000 | 0x204 - 0x80000 | Security Sector | Binary |
| 0x80000 | 0x80000000 | System Cache | STFC (Secure Transacted File Cache) |
| 0x80080000 | 0xA0E30000 | Game Cache | STFC (Secure Transacted File Cache) |
| 0x120eb0000 | 0x10000000 | Xbox 1 Backwards Compatibility | FATX |
| 0x130eb0000 | end of drive | Data | FATX |
Security Sector
The Security Sector is used by Microsoft to verify that the harddrive is an original Microsoft product. The Security Sector holds details such as drive sector count, drive serial number and the Microsoft logo (to stop other companies using it)
The security sector begins at the 16th sector on the drive (0x2000).
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x14 | ascii string | Serial Number |
| 0x14 | 0x8 | ascii string | Firmware Revision |
| 0x1C | 0x28 | ascii string | Model Number |
| 0x44 | 0x14 | bytes | MS Logo Hash |
| 0x58 | 0x4 | unsigned int | Number of Sectors on drive |
| 0x5C | 0x100 | bytes | RSA Signature |
| 0x200 | 0x4 | signed int | MS Logo Size |
| 0x204 | MS Logo Size | image | MS Logo |
Partition Header
For each offset, add the offset of the partition.
| Offset | Length | Type | Information |
|---|---|---|---|
| 0x0 | 0x4 | ascii string | Partition magic (XTAF) |
| 0x4 | 0x4 | unsigned int | Partition ID |
| 0x8 | 0x4 | unsigned int | Sectors per Cluster |
| 0xC | 0x4 | unsigned int | Root directory cluster |
Chainmap and directories
To find the offset of the chainmap, take the offset of the position and add 4096 (0x1000) to it. Each entry in the chainmap is either an unsigned int or a unsigned short, depending on the number of clusters inside the partition. To work out the number of clusters, you first have to take the Sectors per Cluster value and multiply it by 512 (0x200), this is the size of the partitions clusters. Now simply divide the partitions size by the cluster size and you have the number of clusters. If the number of clusters is below 65520 (0xFFF0), then the drive uses 2-byte chain entries, otherwise it uses 4 byte chain entries. The size of the chainmap is the size of the chain entries multiplied by the partitions cluster count.