FATX

FATX is the file system used by the Xbox and the Xbox 360, it is unsupported natively by Windows but has some functionality in Linux.

Partition Locations

Memory Unit

Offset	Length	Information	Format
0x0	0x7FF000	System Cache	STFC (Secure Transacted File Cache)
0x7FF000	end of drive	Data	FATX

Xbox 360 Hard Drive

Offset	Length	Information	Format
0x2000	0x204 - 0x80000	Security Sector	Binary
0x80000	0x80000000	System Cache	STFC (Secure Transacted File Cache)
0x80080000	0xA0E30000	Game Cache	STFC (Secure Transacted File Cache)
0x120eb0000	0x10000000	Xbox 1 Backwards Compatibility	FATX
0x130eb0000	end of drive	Data	FATX

"Josh" Sector

The "Josh" Sector is located on the 4th sector (0x800). It's purpose is currently unknown. It may be used just to identify the Xbox that previously formatted it.

Offset	Length	Type	Information
0x0	0x4	ascii string	"Josh" magic
0x4	0x2	bytes	Public Key Certificate Size
0x6	0x5	bytes	Certificate Owner Console ID
0xB	0x14	ascii string	Certificate Owner Console Part Number
0x1F	0x1	byte	Certificate Owner Console Type (1 for devkit, 2 for retail)
0x20	0x8	ascii string	Certificate Date of Generation
0x28	0x4	bytes	Public Exponent
0x2C	0x80	bytes	Public Modulus
0xAC	0x100	bytes	Certificate Signature
0x1AC	0x80	bytes	Signature

It is then followed by a pair of entries, the format of which is below:

Offset	Length	Type	Information
0x0	0x8	(un?)signed long	Unknown (ID of some kind?)
0x8	0x14	bytes	Unknown (0x14 bytes... SHA1 hash?)
0x1C	0x4	(un?)signed int	Unknown
0x20	0x4	(un?)signed int	Unknown

The sector then ends with the following format:

Offset	Length	Type	Information
0x0	0x4	(un?)signed int	Unknown
0x4	0x4	(un?)signed int	Unknown
0x8	0x4	(un?)signed int	Unknown
0xC	0x4	(un?)signed int	Unknown

I've uploaded my own "Josh" sector to here (644 bytes) Stoker25 19:48, 6 August 2010 (UTC)

Security Sector

The Security Sector is used by Microsoft to verify that the harddrive is an original Microsoft product. The Security Sector holds details such as drive sector count, drive serial number and the Microsoft logo (to stop other companies using it)

It begins at the 16th sector on the drive (0x2000).

Offset	Length	Type	Information
0x0	0x14	ascii string	Serial Number
0x14	0x8	ascii string	Firmware Revision
0x1C	0x28	ascii string	Model Number
0x44	0x14	bytes	MS Logo Hash
0x58	0x4	unsigned int	Number of Sectors on drive
0x5C	0x100	bytes	RSA Signature
0x200	0x4	signed int	MS Logo Size
0x204	MS Logo Size	image	MS Logo

If a Security Sector from a smaller hard drive is used on a bigger one, the Xbox will only see the number of sectors defined in the Security Sector.

Partition Header

For each offset, add the offset of the partition.

Offset	Length	Type	Information
0x0	0x4	ascii string	Partition magic (XTAF)
0x4	0x4	unsigned int	Partition ID
0x8	0x4	unsigned int	Sectors per Cluster
0xC	0x4	unsigned int	Root directory cluster

Chainmap and directories

To find the offset of the chainmap, take the offset of the position and add 4096 (0x1000) to it. Each entry in the chainmap is either an unsigned int or a unsigned short, depending on the number of clusters inside the partition. To work out the number of clusters, you first have to take the Sectors per Cluster value and multiply it by 512 (0x200), this is the size of the partitions clusters. Now simply divide the partitions size by the cluster size and you have the number of clusters. If the number of clusters is below 65520 (0xFFF0), then the drive uses 2-byte chain entries, otherwise it uses 4 byte chain entries. The size of the chainmap is the size of the chain entries multiplied by the partitions cluster count.