|
FAT Disk recovery
|   |
|
FAT Disk recovery
| |
This option is displayed for all FAT disks, ie FAT12, FAT16 and FAT32.
By double clicking on any of the parameter boxes the sector will be displayed.
There are three main restore modes possible for FAT disks, and then several options relating to these modes.
Full Recover.
This is probably the most common mode for restoration. The program will attempt to restore the files as in the normal operating system. However, it is very tolerant of corruption and will often restore many good files from the disk
Recover from directory stubs
This is a mode where the whole partition is searched for possible subdirectory stubs. This a sector that follows the pattern of a subdirectory, or even root directory. The program will then extract each file. Where possible, the program will try and determine the path of the file. If it is not possible, a new subdirectory ‘dirstub0’ will be created.
Recover from Fat
In this mode, the program will read the FAT, and restore files from the chain. Thus chains of files will be restored, but no attempt is made to extract filenames. This should be viewed a s fairly last resort measure, but can occasionally rescue files that would not orther wise be found.
Overwrite existing files
In this mode, output files will be automatically overwritten if the already exist. When this option is disabled, files will be renamed but adding an extention, eg .000, .001 to the name
Recover deleted files
This is a mode where files that have been detected as deleted will be restored. Although this option can often work very well, there are two potential problems. The first is that when a file is deleted, the space it occupies is made available for re-use. It is therefore possible that the original file is overwritten by a new one. The second problem is that when a file is deleted, the FAT is also cleared, so no details of a fragmented file is retained. If the file is not fragmented, then a good recovery can be made. See notes for FAT32 deleted file recovery
Ignore FAT
On some disks, or other media, the FAT is either corrupted, or deleted. One symptom of this problem is when files are restored, but truncated to 16K or 32K When the ignore FAT option is enabled a new dummy FAT will be created. This assumes that all files are sequential, and on a lightly used disk, with short files, a very high success rate can be expected. With very long files, on a full disk, files may well be corrupted
Scan disk to check for sector locations
This is a very specialized option. On a disk that has been physically recovered, it is possible for sectors to be in the wrong location, ie areas of the disk have apparently moved. When this option is selected, the whole disk is scanned, and directory entries are detected. Each directory entry has a pointer to itself, and so it is possible to determine if the sector is in the correct location. A table is then built of possible sector offsets, and zones on the hard disk where these errors are found. It is not always possible to detect the exact boundary of the sector shifting, but on this type of error, this option does improve the restore rate considerably
Recover unused space
This is an extremely useful option, that will scan unused sections of the disk, and try and extract files. If it comes across a valid start of a file, it will produce files based on the signature found. A good example could be lost pictures, or jpegs
Recover Slack space - Forensic option
Slack space is the space that is at the end of a file, when the file length is not an integral length of a cluster. As an example, for a disk with a cluster size of 4K, when a file of 1K< 9K, or 201K is written there will be 3K of slack space at the end of that file. The data in the slack space can be very varied, but could be the contents of memory when the file was written, or what was on the disk before, or a mixture. For forensic investigation, it can give very useful clues to what the user may have thought had been deleted from a system. For recovery purposes, it could add a bit more to a corrupted file.
Analyse disk parameters
FAT disks have a fairly typical range of values. For instance there can only be one or two FAT maps. A cluster size must always be a multiple of 2. If the program detects values that do not make sense it will suggest running the Analyse disk parameters function. This function scans the disk and looks for subdirectories. By finding at least two subdirectories it can work out many of the parameters required to recover the disk. These parameters will be loaded onto the screen, and can be edited if required. Occasionally some trial and error may be required, or direct examination of the proposed sectors.
Errors
A typical error is for files recovered to be truncated. Often they may be just 4K or 16K in length. The normal reason for this is that File Allocation Table (FAT) has become corrupted. Sometimes this will be detected when starting to read the disk with a message indicating that dubious sectors have been discovered. To recover from this type of error just tick the Ignore FAT box and run the recovery again. Most files on a FAT disk are sequential, and so a corrupted FAT can be guessed, but if the file is very long, or fragmented the file may be recovered at the correct length, but there may be corruption
FAT Disk parameters
The disk parameters are the values that FAT disks define them selves with. Thus any conforming FAT disk, or any capacity, may be read by setting these parameters up. CnW software allows for 4 partitions, and each partition will have it's own set of parameters. The parameters can either be displayed in decimal or hex, depending on personal preference. A very useful feature of CnW software is that the default parameters can be overwridden for special recovery purposes. For instance, if you received a corrupted disk where the main directory was in the wrong location, the start directory parameter could be set to see the directory. As these values are not written to the drive, incorrect values will not damage the drive, but files may be recovered correctly.
The best way to initially set up the parameters if the automatically selected values are wrrong, is to use the Analyse disk parameters function.
Parameter descriptions
Cluster size. A cluster on a FAT disk is the smallest number of sectors that can be allocated to a file. On a FAT 16 disk, there are only 65536 possible clusters, and so for any disk above 30MB, a cluster has to be greater than 1 sector. The chosen cluster size for a disk is a compromise between speed and wasted space. A cluster size of 8 means less house keeping, but a small file will always occupy the 8 sectors. To determine the cluster size it is necessary to look through the disk and find the start of small files. The gap between these files will often be the cluster size. A cluster size is always a power of 2, so only 1, 2, 4, 8, 16, 32 and 64 are valid values.
Cluster 2 location. Usable data area on a disk always starts at cluster 2. For a FAT12 and FAT16 disk this is the sector after the end of the root directory. All cluster locations are therefore based on this value. If for instance a disk recovered files, but the first sector of each file was incorrect, this could be caused by the Cluster 2 value being one out.
FAT Start and length. The large majority of FAT disks have 2 FATs (File allocation Table). They are always at the start of the disk, after any boot and loading programs. The two FATs are always sequential and so the length of the first FAT will enable the location of the second FAT to be calculated.
Directory start. For FAT12 and FAT16 disks, the directory start can be determined by finding the end of the second FAT. The length of the directory is then the space beween the FAT end and Cluster 2. For FAT32, the root directory is located anywhere on the disk, and like subdirectories, it's allocation is determined by the FAT. It can therefore be fragmenetd, and of any length. For recovery, all that is required is the sector of the first location.
Sector count. This is not a critical value, but is used to try and prevent accessing areas outside of the partition. If in doubt, enter a larger value, rather than a smaller value.
It should be noted that the sector values are absolute on the disk, and not relative to the partition.