{"id":7599,"date":"2012-02-17T07:29:51","date_gmt":"2012-02-16T21:29:51","guid":{"rendered":"http:\/\/michael.ellerman.id.au\/blog\/?p=7599"},"modified":"2014-10-12T19:34:50","modified_gmt":"2014-10-12T09:34:50","slug":"fat32-filesystem-archaeology","status":"publish","type":"post","link":"https:\/\/michael.ellerman.id.au\/blog\/2012\/02\/17\/fat32-filesystem-archaeology\/","title":{"rendered":"FAT32 Filesystem Archaeology"},"content":{"rendered":"<p>A while back I bought Dad an iRiver E150 so he could make audio recordings of my grandparents. It&#8217;s quite a nice little device and had been doing a fairly good job for a few months, but then all of a sudden some of the recordings wouldn&#8217;t play.<\/p>\n<p>To cut a long and boring story short, I eventually discovered that the device had simply overwritten some of the recordings with others, ie. no I\/O errors or anything nasty, just a software bug.<\/p>\n<p>In the process I looked around for tools to examine FAT filesystems, and didn&#8217;t find much. If anyone knows of any I&#8217;d love to hear about them. In the absence of a proper tool I bodged up some code to do what I needed &#8211; and <em>only<\/em> what I needed.<\/p>\n<p>I&#8217;ve thrown <a href=\"\/files\/junkcode\/fat.c\">the code<\/a> up in case anyone else finds themselves in a similar predicament. The idea is you dd the data off and point the code at it and examine it, it&#8217;s read only. It can dump the FAT, show you orphan clusters (with no dentry pointing at them), search for a value, and save clusters or cluster chains.<\/p>\n<p>Massive thanks to the <a href=\"http:\/\/en.wikipedia.org\/wiki\/File_Allocation_Table\">Wikipedia page on FAT<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A while back I bought Dad an iRiver E150 so he could make audio recordings of my grandparents. It&#8217;s quite a nice little device and had been doing a fairly good job for a few months, but then all of a sudden some of the recordings wouldn&#8217;t play. To cut a long and boring story [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[74],"tags":[17,56],"_links":{"self":[{"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/posts\/7599"}],"collection":[{"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/comments?post=7599"}],"version-history":[{"count":5,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/posts\/7599\/revisions"}],"predecessor-version":[{"id":7604,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/posts\/7599\/revisions\/7604"}],"wp:attachment":[{"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/media?parent=7599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/categories?post=7599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michael.ellerman.id.au\/blog\/wp-json\/wp\/v2\/tags?post=7599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}