Restore methods for deleting files under FAT32

 

Restore methods for deleting files under FAT32 Abstract:Because the FAT32 file system manages files in three parts
File directory item fat table data area

First, you need to know what operations are performed on the underlying hard disk during file deletion in the FAT32 partition.

1. the first byte of the file directory item is changed to E5, the high cluster number of the starting cluster number in this file is cleared (this article only explains that the high cluster number is not cleared or the high cluster number is zero)
2. The cluster chain corresponding to fat is cleared
3. The data zone has not changed.

 

Next, let's take a look at the image captured by winhex. I used vdisk to virtualize a disk. It contains an MP3 song. Now let's take a look at what the previous MP3 song looks like in the file system. The file name is 10 Gbit/s.

Directory items before the file is not deleted

Fat table part,

Part of the previous data zone has not been deleted

 

Next let's take a look at the changes that have taken place after the file is deleted.

File directory item: the first byte is changed to E5

Download (20.43 KB)

The fat table has been cleared.

 

 

No change in data Zone

This is the change before and after deletion. I don't know if you understand it. Next we will resume this mp3 song.
Recovery: Find the starting cluster number of the file. Calculate the number of slice occupied by the file. In this way, the file can be exported.

1,
Go to this file directory

We know that the starting cluster number of FAT32 is composed of two parts: one is offset from 34h-35h and the other is 3A-3B offset,

34 h-35 h: 00 00
The cluster number is 00. The reason is that the original cluster number is 00. After the file is deleted, the high position is cleared. So we cannot see the change. Because we follow the principles of high positions and low positions.
Therefore, the starting cluster number of this file is 00 00 03 H.
Starting cluster no. 3

Next we will calculate the size of the file. The 3c-3fh offset in the directory item is the file size, in bytes

94 7f B0 00 h
Equal to 11597716 bytes, we all know that a sector is 512 bytes, so 11597716/512 = 22651.7890625
Rounding = 22652 sectors this file occupies so many sectors.

Now that the starting cluster number and the number of occupied sectors have been calculated, let's start restoring the file.

Jump to cluster 3 first

 

Cluster 3 corresponds to Sector 1264, that is, the initial sector of the file.

The end slice of the file should be (the starting slice + the number of slice occupied by the file), that is, 1264 + 22652 = 23916.

First, click the start part in the first byte of sector 1264.

Download (150.67 KB)

Then click the block at the end of the last byte in 23916.

 

Right-click any selected slice and choose Edit> copy and select block> place a new file.

The default name is noname. It is saved at any position. The default file extension is dat.
Change the folder extension to MP3.

The file is successfully restored.

 

 

 

Annotation:

In this example, the file recovery is successful based on two prerequisites:

1: High directory item (0x09d034 ~ 0x09d035) after the file is deleted, it is not cleared or it is originally zero.

2: continuous storage of File Content