This document is a description of the file system layout as used on PlayStation 2 memory cards. It's based on the research I did while writing mymc, a utility for working with PS2 memory card images. This document tries to be comprehensive an accurate, but some details may be missing, misleading or just plain wrong. At lot of assumptions had to be made during my research, and it's hard know to what exactly Sony intended in every case. All most all of the names for structures, fields and flags were made up by me. Nothing in this document should be considered official.
For brevity, unused fields and flag bits are omitted from the tables. In most cases unused fields or flags should be assumed to be either reserved or padding and set to zero when writing. In particular, you'll need to pad out the structures to the length given at the top of the table. All values are stored on the card using the little-endian byte order.
A number of terms are used in this document that you may not familiar with or are different from other sources describing PS2 memory cards, so I've created short glossary.
halfwordSince PlayStation 2 (PS2) memory cards use NAND Flash it's helpful to understand some of the basics about this kind of memory works. Flash is a non-volatile form of memory that can be electrically erased and reprogrammed. Since it's non-volatile, meaning it doesn't need power to retain data, and reprogramable, meaning the data stored can be changed, it's the ideal form memory to use in memory card. However, flash memory does have number of limitations which affect how the PS2 uses its memory cards.
One of the limitations is a relatively slow random access time. While much faster than hard disk, NAND flash is much slower than RAM at reading random bytes in memory. Reading the first byte of data from a flash device takes about 25 microseconds. Fortunately, reading on sequentially is much faster. After the first byte is read, each subsequent byte takes only about 50 nanoseconds to read. For this reason NAND flash memory is organized in to pages, similar to how a hard drive is organized into sectors. For example, with the TC58V64AFT, a flash device used in PS2 memory cards, an entire 528 byte page can be read at a sustained 10 Mb/s transfer rate. By comparison, the transfer rate for reading random bytes is much slower, only 40kb/s. Because the serial bus the PS2 uses to talk to memory cards isn't capable of 10 Mb/s, actual transfer rates will be slower.
The biggest limitation of flash devices is how they're written. Instead changing bits of memory to 0 or 1 depending on the data being written, flash memory can only change a bit from 1 to 0. Once a bit of memory has been changed to 0, it can't be changed back to 1 except by erasing it. Erasing is an operation that sets an entire range of memory, called an erase block, to all 1s. Once a block is erased, it can be written through an operation called programming which changes 1 bits to 0 bits. Since an erase block is made up of a number of pages, this makes writing a more complicated operation than it would be on a hard disk. In order to write a single page to a flash device you need to erase to the block that the page belongs to. However, since that will erase all the pages that belong to that block, not just the page being written, you first need to read in all of the other pages that are going to be erased. After the block is erased you then can program the erase block with the contents of the page you're trying to write and along with the content of all the other pages. Some flash devices work the other way, erasing sets the block to all 0s while programming changes 0s to 1s.
Another limitation is that flash memory isn't as reliable as RAM memory. A flash device will typically have a certain number of bad blocks when it ships from the factory, and it's possible for defects to appear in the media as it used. Also, a block can eventually "wear out" after a few hundred thousand program/erase cycles. For this reason each page is divided into two parts, a data area a spare area. The data area is used to store ordinary data, while the much smaller spare area is for software defined error-correcting codes (ECC), wear leveling, bad block remapping, and other functions meant to deal with defects in the media.
The flash devices used in PS2 memory cards have a 528 byte page size. This is divided into a 512 byte data area and 16 byte spare area. The spare area is used to store 12 bytes of ECC data, with the remaining 4 bytes left unused. Erase blocks are 16 pages long. The are 16384 pages, for a total combined raw data area capacity 8,388,608 bytes.
| 0x0000 | Superblock | 
| 0x0001 | Unused | 
| 0x0010 | Indirect FAT Table | 
| 0x0012 | FAT Table | 
| 0x0052 | Allocatable Clusters | 
| 0x3ED2 | Reserved Clusters | 
| 0x3FE0 | Backup Block 2 | 
| 0x3FF0 | Backup Block 1 | 
| 0x3FFF | 
The PS2 memory card file system has a fairly simple design, with some allowances made for the limitations of flash memory. Its overall structure is similar to the well known MS-DOS FAT file system. It uses a file allocation table (FAT) to keep track of allocated space and a hierarchical directory system where all of a file's metadata is stored in its directory entry. Like the FAT file system, which groups disk sectors into clusters, the PS2 memory card file system groups flash memory pages in to clusters. On standard PS2 memory cards, the cluster size 1024 bytes, or 2 pages long.
The key to the PS2 memory card file system is the superblock. Located in the first page of the memory, this is the only part of the file system with a fixed location. While some things like the do end up in fixed locations on standard 8M memory cards, you shouldn't rely on this.
| Offset | Name | Type | Default | Description | 
|---|---|---|---|---|
| 0x00 | magic | byte[28] | - | Identifies the card as being formatted.
Set to the ASCII string " Sony PS2 Memory Card Format ". | 
| 0x1C | version | byte[12] | 1.X.0.0 | Version number of the format used. Version 1.2 indicates full support for bad_block_list. | 
| 0x28 | page_len | half | 512 | Size in bytes of a memory card page. | 
| 0x2A | pages_per_cluster | half | 2 | The number of pages in a cluster. | 
| 0x2C | pages_per_block | half | 16 | The number of pages in an erase block. | 
| 0x2E | - | half | 0xFF00 | Doesn't seem to be used | 
| 0x30 | clusters_per_card | word | 8192 | The total size of the card in clusters. | 
| 0x34 | alloc_offset | word | 41 | Cluster offset of the first allocatable cluster.  Cluster values
in the FAT and directory entries are relative to this. This is the cluster immediately after the FAT | 
| 0x38 | alloc_end | word | 8135 | The cluster after the highest allocatable cluster.  Relative to alloc_offset.Not used. | 
| 0x3C | rootdir_cluster | word | 0 | First cluster of the root directory.  Relative to alloc_offset.Must be zero. | 
| 0x40 | backup_block1 | word | 1023 | Erase block used as a backup area during programming. Normally the the last block on the card, it may have a different value if that block was found to be bad. | 
| 0x44 | backup_block2 | word | 1022 | This block should be erased to all ones. Normally the the second last block on the card. | 
| 0x50 | ifc_list | word[32] | 8 | List of indirect FAT clusters. On a standard 8M card there's only one indirect FAT cluster. | 
| 0xD0 | bad_block_list | word[32] | -1 | List of erase blocks that have errors and shouldn't be used. | 
| 0x150 | card_type | byte | 2 | Memory card type. Must be 2, indicating that this is a PS2 memory card. | 
| 0x151 | card_flags | byte | 0x52 | Physical characteristics of the memory card. | 
| Mask | Name | Description | 
|---|---|---|
| 0x01 | CF_USE_ECC | Card supports ECC. | 
| 0x08 | CF_BAD_BLOCK | Card may have bad blocks. | 
| 0x10 | CF_ERASE_ZEROES | Erased blocks have all bits set to zero. | 
Most of the fields in the superblock should be self-explanatory.
   The fields page_len, pages_per_cluster,
   pages_per_block, and clusters_per_card define the
   basic geometry of the file system.  The FAT can be accessed using
   ifc_list and rootdir_cluster gives the first cluster
   of the root directory.  Cluster offsets in FAT and directory
   entries are all relative to alloc_offset
File systems ment to be compatible with the PS2's memory card
   drivers have a fairly restricted set of geometry options.  The
   field page_size can be either 512 or 1024.  If the page size
   is 512 then pages_per_cluster can either be 1 or 2,
   otherwise it can only be 1.  The limit on pages_per_block is
   16.  There doesn't seem to be any upper limit on
   clusters_per_card, however because of the size of ifc_list
   there can be no more than 8,388,608 allocatable clusters.
   While the clusters the make up the FAT can be located anywhere, the
   value of rootdir_cluster must be 0, indicating that the first
   allocatable cluster is the first cluster of the root directory.
The file allocation table is used for keeping track of which
   clusters are in use and form a linked-list of the clusters that
   belong to each file.  Each entry in the table is a 32-bit value.
   If the the cluster corresponding to the entry is free then the most
   significant bit will be clear.  Otherwise, it will be set and the
   lower 31-bits of the value are the index of the next cluster in the
   file.  These indexes are relative to alloc_offset given in
   the superblock.  A value of 0xFFFFFFFF indicates that this
   entry is the last cluster in the file.
Unlike the MS-DOS FAT file system, the table isn't required to to
   be in single contiguous range of clusters.  Instead a system of
   double-indirect indexing is used that allows the clusters that make
   up the file allocation table to be scattered across file system.
   The ifc_list in the superblock contains a table 32-bit
   cluster indexes (relative to the start of the card).  The entries
   in the ifc_list point to the clusters that make up the
   indirect table.  The indirect table is also a table 32-bit cluster
   indexes and these indexes point to the clusters that make up the
   file allocation table.
So assuming a cluster size of 1024, code to access an entry in the FAT might look something like this:
fat_offset = fat_index % 256 
indirect_index  = fat_index / 256 
indirect_offset = indirect_index  % 256
dbl_indirect_index = indirect_index / 256
indirect_cluster_num = superblock.ifc_table[dbl_indirect_index]
indirect_cluster = read_cluster(indirect_cluster_num)
fat_cluster_num = indirect_cluster[indirect_offset]
fat_cluster = read_cluster(fat_cluster_num)
entry = fat_cluster[fat_offset]
Directories are for the most part like regular files, except that they
   contain directory entries rather than data.  The root directory is
   as its name suggests, the root of the card's hierarchical directory
   structure.  The first cluster of the root directory is given in the
   rootdir_cluster field of the superblock, and subsequent clusters
   (if any) can be found by following chain of linked clusters in the FAT.
| Mask | Name | Description | 
|---|---|---|
| 0x0001 | DF_READ | Read permission. | 
| 0x0002 | DF_WRITE | Write permission. | 
| 0x0004 | DF_EXECUTE | Execute permission. Unused | 
| 0x0008 | DF_PROTECTED | Directory is copy protected. Meaningful only to the browser. | 
| 0x0010 | DF_FILE | Regular file. | 
| 0x0020 | DF_DIRECTORY | Directory. | 
| 0x0040 | - | Used internally to create directories. | 
| 0x0080 | - | Copied? | 
| 0x0100 | - | - | 
| 0x0200 | O_CREAT | Used to create files. | 
| 0x0400 | DF_0400 | Set when files and directories are created,
otherwise ignored. | 
| 0x0800 | DF_POCKETSTN | PocketStation application save file. | 
| 0x1000 | DF_PSX | PlayStation save file. | 
| 0x2000 | DF_HIDDEN | File is hidden. | 
| 0x4000 | - | - | 
| 0x8000 | DF_EXISTS | This entry is in use.
If this flag is clear, then the file or directory has been deleted. | 
| Offset | Name | Type | Description | 
|---|---|---|---|
| 0x00 | mode | half | See directory mode table. | 
| 0x04 | length | word | Length in bytes if a file, or entries if a directory. | 
| 0x08 | created | byte[8] | Creation time. | 
| 0x10 | cluster | word | First cluster of the file, or 0xFFFFFFFFfor an empty file.
In "." entries this the first cluster of this directory's parent
directory instead.
Relative toalloc_offset. | 
| 0x14 | dir_entry | word | Only in "." entries.  Entry of this directory
in its parent's directory. | 
| 0x18 | modified | byte[8] | Modification time. | 
| 0x20 | attr | word | User defined attribute | 
| 0x40 | name | byte[32] | Zero terminated name for this directory entry. | 
The first two directory entries in any directory are always two
   dummy entries named "." and "..", in that order.  In path names,
   these two directory entries represent the current directory and the
   parent directory, as they do in Unix, but they serve different
   purposes in the file system.  The first directory entry, the "."
   entry, is used to store a link to the parent directory.  The second
   entry serves no purpose except as a place holder.  The fields these
   entries do not reflect state of the directories that they are
   supposed to refer to.  The length and cluster fields
   are always set 0 and the modified time never changes.
The first directory entry in the root directory is special case.
   It fills the role of the root directory's own directory entry.
   Unlike the "." entry in other directories, the fields in this entry
   are used and reflect the state of the root directory.  In
   particular, the length field contains the number of
   directory entries root directory.  The exception is the
   cluster field which isn't used.
| Offset | Name | Type | Description | 
|---|---|---|---|
| 0x01 | sec | byte | seconds | 
| 0x02 | min | byte | minutes | 
| 0x03 | hour | byte | hours | 
| 0x04 | day | byte | day of the month | 
| 0x05 | month | byte | month (1-12) | 
| 0x06 | year | word | year | 
The created and modified fields use the time format
   given in the Time of Day table.  All time stamps use the Japan
   timezone (+9 UTC), regardless of the timezone the PS2 console was
   configured to use.  A four digit year used.
Most of the mode flags don't serve any purpose in the structure of
   the file system and only have meaning to higher level software,
   like the PS2 browser.  The DF_PSX flag indicates that file
   was copied from a PSX memory card.  If the DF_POCKETSTN flag
   is set as well, the file is a PocketStation application file copied
   from a PocketStation.  
Each directory entry is a massive 512 bytes long, so only two
   entries fit in each 1024 cluster.  The unused bytes at the end of
   directory could be used for a longer name, but normally names are
   truncated to only 32 bytes.  File names are case sensitive, and the
   characters "?", "*", and "/" along with all
   ASCII control characters are illegal in files.
A number of strategies are employed in the file system to handle errors are likely to occur when using memory cards.
The first line defence is the use of error correcting codes to deal with any defects in the card's flash media. The 512 byte data area of each page is divided into 128 byte long chunks and for each chunk a simple 20-bit Hamming code is calculated. This code allows a single bit error in a chunk to be both detected and corrected. A total of three bytes are used to store this 20-bit Hamming code. The first byte contains the column (or bit-wise) parity bits, with the even groups in the lower nibble and the odd groups in the upper nibble. The second and third bytes contain the even and odd groups respectively for the line (or byte-wise) parity bits. The three ECC bytes for each of the four 128-byte chunks of a page are stored in order in the page's spare area.
Two complete erase blocks are reserved to deal with the possibility of the memory card being removed by the user when data is being saved. Since writing a single cluster to card requires erasing and reprogramming the entire erase block the cluster belongs to, a failure during programming could destroy more then just data being written. The two backup blocks are used to ensure the an program operation completes atomically. Either programming completes successfully and no data is lost, or the erase block being programmed is left unchanged and only the new data being written is lost.
Before programming an erase block, both backup_block1 and
   backup_block2 are erase.  Then backup_block1
   programmed with a backup copy of the new data for block, and the
   number of the erase block being programmed is written at the start
   of the backup_block2.  The erase block being programmed is
   then erased and programmed.  Finally, backup_block2 is erased.
Recovery from failed program operation caused by removal of the
   memory card is implemented whenever a memory card is inserted into
   the PS2.  First backup_block2 is checked, if it's in a
   erased state then the last programming operation completed
   successfully and nothing else is done.  If it's not erased, then
   programming is assumed to have not been completed.  The contents of
   backup_block1 are then copied to the erase block given in
   the first word of backup_block2.  Then backup_block2
   is erased.
The last defence against errors is a list of bad erase blocks kept
   in the superblock.  If any part of an erase block is found to be
   defective it can be added to bad_block_list.  No new
   clusters in this block should be allocated, however clusters
   already allocated in the block can still continue to be used.
The standard PS2 memory card drivers artificially reduce the number
   allocatable clusters by rounding the number down to the nearest
   1000s clusters.  Since clusters in blocks in the
   bad_block_list don't count as against the limit, this
   effectively creates a range of reserved replacement clusters.  As
   blocks are marked as bad, clusters in reserved range become
   available and so the apparent capacity of the memory card remains
   the same.  This was probably implemented so that memory cards
   shipped with varying numbers of bad blocks would all appear to have
   the same amount of free space in the PS2 browser.