reading stranded clusters and FAT tables / data recovery / large partitions
 

I am currently trying to read data from a corrupted FAT32 partition
and am looking from some technical advice. The logical drive concerned
contained several 100 mp3 files, for which I have the audio CDs and
separate backup, but also a few dozen video mpg's which I would like
to retrieve. The full partition size is just under 40GB and I believe
the cluster stucture must still be intact since Windows Explorer
reported 0 files found but only 13GB free, the rest presumably still
assigned.

My question is the following. Although undelete software does not seem
able to help (I think the pointer to each cluster is corrupted, this
is a large volume and I think these are addressed differently) I can
still read the file sizes. Given the the cluster information (used to
determine, for example, the free storage allocation) can I then match
the file names to the clusters using file size? The files are large
(50-500MB) so their precison is quite high and also I don't have many
of them.

I am currently using Active@Undelete which is very nice but could also
process and FAT information using Perl or R. Are there any simple
introductions to this subject or simple programs which can read FAT
information or extract clusters to files on another file system.

As you can see, I am no expert in this field but am happy programming
and dealing with numbers etc.

If it helps, I suspect that the initial data loss may have been caused
by RealPlayer crashing during a library re-sync but this may only be a
presumption.

- david

I'm no expert either but I thought FAT32 was just like FAT16 except
the pointers were wider. That is, there are two separate copies of
the FAT (primary and secondary) just in case the primary gets
clobbered in a crash. Maybe that can solve your problem. Also, the
FAT entry points only to the first file block. Each block then
contains a pointer to the next block.

Maybe this program can help also:

http://www.briggsoft.com/dsnoop.htm

I would scan the whole disk for directory blocks.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation

http://www.storagecraft.com

"David R Wille" wrote in message
om...
I am currently trying to read data from a corrupted FAT32 partition
and am looking from some technical advice. The logical drive concerned
contained several 100 mp3 files, for which I have the audio CDs and
separate backup, but also a few dozen video mpg's which I would like
to retrieve. The full partition size is just under 40GB and I believe
the cluster stucture must still be intact since Windows Explorer
reported 0 files found but only 13GB free, the rest presumably still
assigned.

My question is the following. Although undelete software does not seem
able to help (I think the pointer to each cluster is corrupted, this
is a large volume and I think these are addressed differently) I can
still read the file sizes. Given the the cluster information (used to
determine, for example, the free storage allocation) can I then match
the file names to the clusters using file size? The files are large
(50-500MB) so their precison is quite high and also I don't have many
of them.

I am currently using Active@Undelete which is very nice but could also
process and FAT information using Perl or R. Are there any simple
introductions to this subject or simple programs which can read FAT
information or extract clusters to files on another file system.

As you can see, I am no expert in this field but am happy programming
and dealing with numbers etc.

If it helps, I suspect that the initial data loss may have been caused
by RealPlayer crashing during a library re-sync but this may only be a
presumption.

- david

Many thanks for these replies. Directory Snoop
(http://www.briggsoft.com/dsnoop.htm) does indeed appear to be able to
read and save both fat tables and number clusters and this with
directory scan information from active@undelete should be enough to
piece everything together. The active undelete documentation includes a
nice summary of FAT structure with some links to Micosoft resources
that I have still to follow. One again many thanks.

David