Any filename longer than 8 + 3 characters, or any filename using both uppercase and lowercase letters is assigned multiple directory entries. For example, let's create a sample 26-character filename ABCDEFGHIJKLMNOPQRSTUV.TXT, saved as a text file in the root directory of drive A. Windows creates three directory entries for this file. The first, located at offset 01A0, contains the last 13 characters of the filename. The second, located at offset 01C0, contains the first 13 characters of the filename. The third, at offset 01E0, contains the shortened DOS filename for compatibility with pre-6.0 versions of DOS:
01A0 42 4E 00 4F 00 50 00 51-00 52 00 0F 00 27 53 00 BN.O.P.Q.R...'S. 01B0 54 00 55 00 56 00 2E 00-54 00 00 00 58 00 54 00 T.U.V...T...X.T. 01C0 01 41 00 42 00 43 00 44-00 45 00 0F 00 27 46 00 .A.B.C.D.E...'F. 01D0 47 00 48 00 49 00 4A 00-4B 00 00 00 4C 00 4D 00 G.H.I.J.K...L.M. 01E0 41 42 43 44 45 46 7E 31-54 58 54 20 00 50 56 6B ABCDEF~1TXT .PVk 01F0 A9 26 A9 26 00 00 57 6B-A9 26 00 00 00 00 00 00 .&.&..Wk.&......
Let's start with the entry at 01C0 containing the first 13 characters of the filename, "ABCDEFGHIJKLM". Each Unicode character is 16-bits, stored in "little endian" order:
01C0 01 41 00 42 00 43 00 44-00 45 00 0F 00 27 46 00 .A.B.C.D.E...'F. 01D0 47 00 48 00 49 00 4A 00-4B 00 00 00 4C 00 4D 00 G.H.I.J.K...L.M.
The first byte, containing 01, appears to be a marker. Notice that the attribute byte at offset 0B equals 0F, indicating that this is an extended filename entry.
Next, the entry at 01A0 contains the final 13 characters of the actual filename, "NOPQRSTUV.TXT":
01A0 42 4E 00 4F 00 50 00 51-00 52 00 0F 00 27 53 00 BN.O.P.Q.R...'S. 01B0 54 00 55 00 56 00 2E 00-54 00 00 00 58 00 54 00 T.U.V...T...X.T.
Finally, the auto-generated short filename is built from the first six letters of the actual filename, followed by ~1, followed by the first three characters after the last period in the original name:
01E0 41 42 43 44 45 46 7E 31-54 58 54 20 00 50 56 6B ABCDEF~1TXT .PVk 01F0 A9 26 A9 26 00 00 57 6B-A9 26 00 00 00 00 00 00 .&.&..Wk.&......
The short filename entry contains all essential file information, including the date, time, starting cluster number, and file size.
Last update: 08/26/08