If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
reading stranded clusters and FAT tables / data recovery / large partitions
I am currently trying to read data from a corrupted FAT32 partition
and am looking from some technical advice. The logical drive concerned contained several 100 mp3 files, for which I have the audio CDs and separate backup, but also a few dozen video mpg's which I would like to retrieve. The full partition size is just under 40GB and I believe the cluster stucture must still be intact since Windows Explorer reported 0 files found but only 13GB free, the rest presumably still assigned. My question is the following. Although undelete software does not seem able to help (I think the pointer to each cluster is corrupted, this is a large volume and I think these are addressed differently) I can still read the file sizes. Given the the cluster information (used to determine, for example, the free storage allocation) can I then match the file names to the clusters using file size? The files are large (50-500MB) so their precison is quite high and also I don't have many of them. I am currently using Active@Undelete which is very nice but could also process and FAT information using Perl or R. Are there any simple introductions to this subject or simple programs which can read FAT information or extract clusters to files on another file system. As you can see, I am no expert in this field but am happy programming and dealing with numbers etc. If it helps, I suspect that the initial data loss may have been caused by RealPlayer crashing during a library re-sync but this may only be a presumption. - david |
#2
|
|||
|
|||
I'm no expert either but I thought FAT32 was just like FAT16 except
the pointers were wider. That is, there are two separate copies of the FAT (primary and secondary) just in case the primary gets clobbered in a crash. Maybe that can solve your problem. Also, the FAT entry points only to the first file block. Each block then contains a pointer to the next block. Maybe this program can help also: http://www.briggsoft.com/dsnoop.htm |
#3
|
|||
|
|||
I would scan the whole disk for directory blocks.
-- Maxim Shatskih, Windows DDK MVP StorageCraft Corporation http://www.storagecraft.com "David R Wille" wrote in message om... I am currently trying to read data from a corrupted FAT32 partition and am looking from some technical advice. The logical drive concerned contained several 100 mp3 files, for which I have the audio CDs and separate backup, but also a few dozen video mpg's which I would like to retrieve. The full partition size is just under 40GB and I believe the cluster stucture must still be intact since Windows Explorer reported 0 files found but only 13GB free, the rest presumably still assigned. My question is the following. Although undelete software does not seem able to help (I think the pointer to each cluster is corrupted, this is a large volume and I think these are addressed differently) I can still read the file sizes. Given the the cluster information (used to determine, for example, the free storage allocation) can I then match the file names to the clusters using file size? The files are large (50-500MB) so their precison is quite high and also I don't have many of them. I am currently using Active@Undelete which is very nice but could also process and FAT information using Perl or R. Are there any simple introductions to this subject or simple programs which can read FAT information or extract clusters to files on another file system. As you can see, I am no expert in this field but am happy programming and dealing with numbers etc. If it helps, I suspect that the initial data loss may have been caused by RealPlayer crashing during a library re-sync but this may only be a presumption. - david |
#4
|
|||
|
|||
Many thanks for these replies. Directory Snoop
(http://www.briggsoft.com/dsnoop.htm) does indeed appear to be able to read and save both fat tables and number clusters and this with directory scan information from active@undelete should be enough to piece everything together. The active undelete documentation includes a nice summary of FAT structure with some links to Micosoft resources that I have still to follow. One again many thanks. David |
Thread Tools | |
Display Modes | |
|
|