- FAT16 decoding
- Posted by tobin fricke on April 6th, 2004
I'm messing with the image of a FAT16 volume in an attempt to retrieve
data from a volume that was accidentally formatted (whoops!). The
symptom of the formatting was that the FAT was zeroed out and a few
new files were written, but I figure that most of the data should be
okay, and that, assuming the disk wasn't *too* fragmented, I should be
able to get some data out.
Question regarding interpretation of a directory entry: a directory
entry gives a starting cluster for a file. How do I convert this to a
byte offset? My current calculation is this:
root_dir_offset = (reserved_clusters * sectors_per_cluster + n_fats *
sectors_per_fat)*bytes_per_sector;
offset = root_dir_offset + max_root_dir_entries*32 +
(starting_cluster * bytes_per_cluster);
That seems right.. but the data isn't there! maybe my filesystem is
more screwed up than I thought. or.. ?
- Posted by Svend Olaf Mikkelsen on April 6th, 2004
On 5 Apr 2004 18:26:48 -0700, tobin@splorg.org (tobin fricke) wrote:
There is no such thing as reserved_clusters. There are reserved
sectors. For FAT16 most often 1, the boot sector.
Remember that the first cluster is cluster 2.
--
Svend Olaf
- Posted by tobin fricke on April 6th, 2004
svolaf@inet.uni2.dk (Svend Olaf Mikkelsen) wrote in message news:<4072631a.6544839@dtext.news.tele.dk>...
What does that really mean? That the first cluster of the data area
is designated "cluster 2", and that I should therefore subtract 2
clusters from my calculation?
thanks,
Tobin
- Posted by Svend Olaf Mikkelsen on April 6th, 2004
On 6 Apr 2004 14:15:17 -0700, tobin@splorg.org (tobin fricke) wrote:
Try it? On a known good partition first?
--
Svend Olaf