Fat16 File System Manual data recovery Analysis

The root directory item (root entries) is 512, and each directory item occupies 32 bytes. Therefore, FDT (file directory table) occupies 512*32/512 = 32 sectors. The 512 directory items are the sum of all the registration items under the root directory, including the volume label, subdirectory, and file.

Formula

Exact Method: fatNumber of sectors =(Total number of sectors + 2 *Number of sectors per cluster-32-Number of reserved sectors )/(256 *Number of sectors per cluster)

Example: Number of fat sectors = (3915713 + 128-32)/(256*64) = 238.99029541015625 = 239 sectors

Rough method: fatNumber of sectors: fatRecord a cluster in two bytes.

Example: Number of fat sectors = Total number of clusters * 2/512 = (3915713/64)/256 = 238.99615478515625 = 239 sectors

Fat16 File System Structure

The storage location of a file or subdirectory on the disk (logical sector number) is:

1 + 2 * fatNumber of sectors + FDTNumber of sectors +(Starting cluster number-2)*Number of sectors per cluster

Explanation: "1" indicates the DBR sector, and "Start cluster number-2" indicates that the user file is calculated from cluster 2. In this case, the starting point (2nd clusters) of the first file is closely followed by FDT.

DBR pilot

DBRRelationship with the shard location

The DBR of each partition is located in the first sector of the partition. The primary partition DBR is determined by MBR, and the extended partition is specified by virtual MBR.

DBRRelationship with the location of the Partition Table

DBR of the first primary partition is generally 62 from the MBR (MBR = 0, DBR = 63). Since each extended partition has a virtual MBR, therefore, each extended partition DBR is 62 sectors away from the virtual MBR.

Here we can recall the reading method of the Partition Table chain: the primary partition is located directly by the "number of sectors before this partition" in the MBR table item; an offset must be added to the extended partition, that is, the "number of sectors before the expansion partition" defined in the MBR, And the offset remains unchanged in all virtual MBR (this is a bit different from taking it for granted ~), Remember.

Fat (File associate table)

Fat is then stored in the DBR sector. Each cluster on the disk has only one register item in fat, and the table item value has three statuses: occupied, idle, or bad. Fat has 12, 16, and 32 digits. The 12-bit table value can represent 4096 clusters, and the 16-bit table value can represent 65536 clusters (generally, each cluster has no more than 64 sectors (32 KB, fat16 can manage up to 32*65536 = 2 GB ). FAT32 can manage 16 TB partitions even if the size of each cluster is 4 kb.

FAT file location

Located by fat + FDT. Each 32 bytes of FDT represents a file. The most important part is the offset of 1A-1B, which indicates the start cluster number of the file (this cluster number is useful in two ways. One is to locate the data in the file, second, find the next cluster of files in fat ).

For example, find “winhex "and search for ASCII to FDT.

The starting offset of fat1 is 0x200, and the file length is 0x86a0f3. Therefore, the offset to be located is 0x16b2.

We continued and found that the cluster chain was connected and there seemed to be no fragments!

OK ,the range of the winhex cluster is 0xa59 ~ 0xb66 (2649 ~ 2918 clusters)

The file length is 0xf3a08600. We can see that each cluster has 64 sectors. 32768 = 0x8000, 0x86a0f3 mod 0x8000 = 0x20f3, that is, the last cluster occupies 0x20f3 bytes.

Starting with the last cluster

0x5b5fe00 + 0x20f3 = 0x5b61ef3

In hash, the results are exactly the same. That's right.