FAT16 decoding

  • Thread starter Thread starter tobin fricke
  • Start date Start date
T

tobin fricke

I'm messing with the image of a FAT16 volume in an attempt to retrieve
data from a volume that was accidentally formatted (whoops!). The
symptom of the formatting was that the FAT was zeroed out and a few
new files were written, but I figure that most of the data should be
okay, and that, assuming the disk wasn't *too* fragmented, I should be
able to get some data out.

Question regarding interpretation of a directory entry: a directory
entry gives a starting cluster for a file. How do I convert this to a
byte offset? My current calculation is this:

root_dir_offset = (reserved_clusters * sectors_per_cluster + n_fats *
sectors_per_fat)*bytes_per_sector;

offset = root_dir_offset + max_root_dir_entries*32 +
(starting_cluster * bytes_per_cluster);

That seems right.. but the data isn't there! maybe my filesystem is
more screwed up than I thought. or.. ?
 
I'm messing with the image of a FAT16 volume in an attempt to retrieve
data from a volume that was accidentally formatted (whoops!). The
symptom of the formatting was that the FAT was zeroed out and a few
new files were written, but I figure that most of the data should be
okay, and that, assuming the disk wasn't *too* fragmented, I should be
able to get some data out.

Question regarding interpretation of a directory entry: a directory
entry gives a starting cluster for a file. How do I convert this to a
byte offset? My current calculation is this:

root_dir_offset = (reserved_clusters * sectors_per_cluster + n_fats *
sectors_per_fat)*bytes_per_sector;
Click to expand...

There is no such thing as reserved_clusters. There are reserved
sectors. For FAT16 most often 1, the boot sector.
offset = root_dir_offset + max_root_dir_entries*32 +
(starting_cluster * bytes_per_cluster);
Click to expand...

Remember that the first cluster is cluster 2.
 
Remember that the first cluster is cluster 2.
Click to expand...

What does that really mean? That the first cluster of the data area
is designated "cluster 2", and that I should therefore subtract 2
clusters from my calculation?

thanks,
Tobin
 
What does that really mean? That the first cluster of the data area
is designated "cluster 2", and that I should therefore subtract 2
clusters from my calculation?

thanks,
Tobin
Click to expand...

Try it? On a known good partition first?
 
Back
Top