Issues about FAT Data Recovery

By: Jens White | Sep 3 2013 | 917 words | 2158 hits

FAT file system in the widely used file system type of Windows operating system, and FAT32 format files can also be read on both Windows and Mac, therefore, the discuss about possibility of FAT data recovery and data loss is also more popular. Most Windows or mac recovery software such as Kvisoft Data Recovery for Mac can achieve FAT recovery. But, there are some issues of FAT file system data recovery need to be considered when you do FAT32 data recovery by yourself.

Directory fragmentation problem
When recovering data, there is one issue to note that a directory having a plurality of clusters can easily be fragmented. Because the directory is assigned the second cluster only when it is needed, and the cluster space of this directory after the first cluster is unlikely to be idle (mostly because of the space will be allocated to a file of the directly), it is very difficult to recovery the directory completely. However, if you have multiple clusters directory is copied as a whole, or have recently done defrag, all clusters are contiguous and it is possible to complete recovery.
File name problem
When file is deleted, the first byte of its directory is changed to OxE5 to indicate that it has been deleted. For short file name, this will make the first byte of the file name to be overwritten, and for long file name, will overwrite its serial number. For data recovery, there maybe two problems: File name completion problem. When recover deleted files, we need to cover the first name of the file name; if the file has a long file name, we can find its first character from its long file name. When you delete a directory, the original directories that included in this directory maybe changed, or may not be changed. Duplicate name problem. When a directory is cancelled assigned, its first byte (also the first number of file name) will be deleted (replaced 0xE5), if there are two files named as A-1.txt and B-1.txt is deleted, then their names in the directory will be changed as “_-1.txt”, this will occur name confliction when do searching.
Solitary directories and solitary files problem
There is also a problem when a directory is reassigned after deleted. In this case, the current directory is no longer pointing to the original file or directory, so the original files and directories will be no directory pointing to them, they cannot be located. For example, a directory pointing to the original cluster 210, then the directory is deleted and re-allocated, now points to the cluster 400, the content of cluster 210 still exists, but we cannot simply find them through the directory tree, we cannot know whether they exist, then these files are called solitary directory or solitary files.
Solitary directory
To find the solitary directory, each sector from the data area needed to be check, there is no standard required for checking, one way is to check the first 32 bytes of each sector (not the cluster),to see whether they comply with the structure of the directory. If they meet the structure of directory, it should continue to view the rest of this sector in order to find other available information. Inspect for each sector to avoid missing out those slack space directories from the cluster that is allocated to other files. Another similar method is to search the first 32 bytes of each cluster to see whether they are a “.” directory, because the first directory of each directory must be a “.” directory, but this method can only find the first cluster of the directory, cannot find other clips. During the implementation of the procedure, one method to solve these problems is creating additional directory address sequence. For example, some software and some Unix operating system will assume that all sectors are assigned to directories, each sector is divided into 16 items which size of 32 bytes, assuming each item is a directory, and then from the first item of the data area of the first sector beginning backwards sequentially numbered, the first item in the directory as for number 0, the second is the 1st directory. However, there is still an obvious problem, each file and directory will have a directory pointing to it, but the root directory does not have. This is because the location of the root directory (for FAT12/16 also included size value) is recorded in the boot sector, and not described from the directory in the data area. Some software to solve this problem by assigning the 2nd root directory as the directory address number, and then starts allocated backwards from three. That data area starting sector of the first term is the 3rd directory entries.
Solitary file
To find the solitary file, currently the best method is based on a specific file format of the file header and end of the file to find. This way is very effective for a file stored in a row, but cannot recover well for fragmented files. Allocation strategy problem
Win XP allocation procedure allows the file name to be longer retention time after deleted because it is not available using the first allocation strategy. But this does not mean that the use of the first available allocation strategy can be recovered more data because the contents of the file original space occupied by the clusters may have been reassigned out, so the contents of the file will be overwritten. Therefore, even if able to see the file name, but does not necessarily recover its data content.

About author:
The author is blogger on Kvisoft.com. Kvisoft Data Recovery for MAC is Mac data recovery software specially developed for Mac OS. It can help you do FAT data recovery, and recover lost and deleted files from formatted or damaged hard drive as well as from external hard drives, Flash drive, memory card, memory stick, mobile phones, digital cameras, iPods, Android and other media storage devices.