As we all know, file directory of FAT16 is 32 bytes, now let’s take an example. We divide a partition of approximately 118M by system disk manager, and make each cluster of 2KB i.e. 4 sectors a cluster. Then in the root directory we create a text files whose BPB parameter are:
The name of the text file is file1.txt, its size is 12KB, and it covers 6 clusteres. Its contents are:
It is opened by wordpad, the FDT of its partition is:
It is the content of file directory. The first directory entry is volume label whose attribute byte is 08H, which is 00001000B. Now we will analysis the file1.txt:
From this FDT entry, we may know that the size of file1.txt file have 11422 bytes, the start cluster is 02H. So, on one hand we may search file1.txt in the 2nd cluster of DATA; on the other hand we may search its successor cluster in FAT table. Take a look at the first step: make sure of logical sector of the 2nd cluster. From the BPB parameters block chart we may know, there reserved 1 sector, 2 FAT tables. The length of each FAT table have 235 sectors, FDT takes 32 sectors. So the start sector of DATA is: 1+235*2+32=503, each cluster has 4 sectors, then the start sector of the
2nd cluster is: 503+ (2-2) *4=503. The text files contents are:
From the chart we can see, when every segment ends, it is marked with“0D 0A”, which means “enter” and “newline” The second step is to find cluster chain. The FAT is:
In FDT, the start cluster of the file is 2, then the corresponding offset address of the 2nd cluster is: 2*2=4, that is the two bytes from the offset 4, is the entrance of file file1.txt in FAT. These two bytes are “03 00”, therefore the following file is saved in the 0003 clustere. We can seek the content and the FAT chain of the file in offset 3*2=6.
From the FAT we may see, the place used to record cluster 0 and cluster 1 is “F8 FF FF FF”, which is the fixed start mark of FAT table in FAT16 file system. The cluster number starts from 2, corresponding with its offset address. When computing the offset address, we can do nothing but to multiply 2.
Following this cluster chain, we can find “0700”, that is the 7th cluster, which locates in 503+ (7-2) *4=523 sector; then we obtain “FF FF” in the FAT, which indicates the end of file. Hence we’ve found the whole file. For the last cluster, it has not been used up. The place where it ends can be calculated according to the file length. In FDT record,.the size of file1.txt file is 11422 bytes, we may figure out 11422 DIV 512=22, therefore, the file actually takes 22 integer sectors and part of the 23rd sector, 503+22=525. The last sector of file is the 525th sector. 11422 MOD 512=158, so the last sector only uses 158 bytes, that is 158D=9E of hexadecimal. Therefore the last sector uses
0~ 9DH bytes.
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.