Problems and solutions involved with deleted FAT32 recovery

When files are deleted in the FAT system, the directory entry is marked as deleted, by placing a 0xE5 as the first value of the file name. Undeleting in the simplest term should the be to replace the first character with a letter, and not 0xE5.. The problem is then to know where the file starts, how long it is, and if it is fragmented.

The directory entry for a FAT disk contains the file length. This is 4 bytes long, and hence the file length limit of 4GB. When an entry is deleted, this value is left intact.

The file location is calculated from the cluster number in the directory. For FAT32, the cluster number is 4 bytes long (32 bits). The first 16 bits are stored in the same location as on FAT12 and FAT16 disks. This value is not changed when the file is deleted. However, the high 16 bits for FAT32 are also stored in the directory entry, but when the file is deleted, these entries are also cleared. This means that for recovery, only part of the file location cluster number is known which means it is often considered impossible to recover such files.

CnW Recovery software does work around these issues by doing a lot of intelligent looking. As the file name is known, it is often possible to determine the file type, eg a .csv or .pdf file. It is therefore possible to search the disk for a suitable starting location, with the correct file type. This never going to be 100% fool proof, but it can have a very high success rate. Many recovery programs just do not try, and so a large number of files can not be recovered.

The final recovery problem is that of the file allocation table. This table is used to say how a file is stored on the disk, starting with the first cluster pointed to by the directory. Unfortunately, the only viable first approach is to guess that the file is sequential, and often for short to medium sized files, this is the correct answer. For a long file on a full disk, success is very limited. For some file types, the raw fragmented routine may well assist.

A very good way to use CnW Recovery to recover deleted files is to scan the whole disk for Directory stubs which will then track any old subdirectories that have become isolated from the main directory tree.

With all undelete problems, it is essential that nothing is done to the disk drive until all files have been recovered. Any writing to the drive can overwrite a file that is required for recovery.

Download the demo now, and see files that have been deleted