|
Home > Archive > Data Storage > December 2004 > reading stranded clusters and FAT tables / data recovery / large partitions
You are viewing an archived Text-only version of the thread.
To view this thread in it's original format and/or if you want to reply to
this thread please [click here]
| Author |
reading stranded clusters and FAT tables / data recovery / large partitions
|
|
| David R Wille 2004-12-28, 5:46 pm |
| I am currently trying to read data from a corrupted FAT32 partition
and am looking from some technical advice. The logical drive concerned
contained several 100 mp3 files, for which I have the audio CDs and
separate backup, but also a few dozen video mpg's which I would like
to retrieve. The full partition size is just under 40GB and I believe
the cluster stucture must still be intact since Windows Explorer
reported 0 files found but only 13GB free, the rest presumably still
assigned.
My question is the following. Although undelete software does not seem
able to help (I think the pointer to each cluster is corrupted, this
is a large volume and I think these are addressed differently) I can
still read the file sizes. Given the the cluster information (used to
determine, for example, the free storage allocation) can I then match
the file names to the clusters using file size? The files are large
(50-500MB) so their precison is quite high and also I don't have many
of them.
I am currently using Active@Undelete which is very nice but could also
process and FAT information using PERL or R. Are there any simple
introductions to this subject or simple programs which can read FAT
information or extract clusters to files on another file system.
As you can see, I am no expert in this field but am happy programming
and dealing with numbers etc.
If it helps, I suspect that the initial data loss may have been caused
by RealPlayer crashing during a library re-sync but this may only be a
presumption.
- david
| |
| Paul Rubin 2004-12-28, 5:46 pm |
| I'm no expert either but I thought FAT32 was just like FAT16 except
the pointers were wider. That is, there are two separate copies of
the FAT (primary and secondary) just in case the primary gets
clobbered in a crash. Maybe that can solve your problem. Also, the
FAT entry points only to the first file block. Each block then
contains a pointer to the next block.
Maybe this program can help also:
http://www.briggsoft.com/dsnoop.htm
| |
| Maxim S. Shatskih 2004-12-28, 5:46 pm |
| I would scan the whole disk for directory blocks.
--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com
"David R Wille" <david.wille@gmx.ch> wrote in message
news:705deac8.0412280706.53f34971@posting.google.com...
> I am currently trying to read data from a corrupted FAT32 partition
> and am looking from some technical advice. The logical drive concerned
> contained several 100 mp3 files, for which I have the audio CDs and
> separate backup, but also a few dozen video mpg's which I would like
> to retrieve. The full partition size is just under 40GB and I believe
> the cluster stucture must still be intact since Windows Explorer
> reported 0 files found but only 13GB free, the rest presumably still
> assigned.
>
> My question is the following. Although undelete software does not seem
> able to help (I think the pointer to each cluster is corrupted, this
> is a large volume and I think these are addressed differently) I can
> still read the file sizes. Given the the cluster information (used to
> determine, for example, the free storage allocation) can I then match
> the file names to the clusters using file size? The files are large
> (50-500MB) so their precison is quite high and also I don't have many
> of them.
>
> I am currently using Active@Undelete which is very nice but could also
> process and FAT information using PERL or R. Are there any simple
> introductions to this subject or simple programs which can read FAT
> information or extract clusters to files on another file system.
>
> As you can see, I am no expert in this field but am happy programming
> and dealing with numbers etc.
>
> If it helps, I suspect that the initial data loss may have been caused
> by RealPlayer crashing during a library re-sync but this may only be a
> presumption.
>
> - david
| |
| david.wille@gmx.ch 2004-12-31, 5:45 pm |
| Many thanks for these replies. Directory Snoop
(http://www.briggsoft.com/dsnoop.htm) does indeed appear to be able to
read and save both fat tables and number clusters and this with
directory scan information from active@undelete should be enough to
piece everything together. The active undelete documentation includes a
nice summary of FAT structure with some links to Micosoft resources
that I have still to follow. One again many thanks.
David
|
|
|
|
|