Recovering files from FAT disks and memory chips

When the Recover function is selected from the CnW menu, if it is a FAT32, FAT16 or FAT12 disk, the dialog option box shown below is displayed Many flash memory devices, and camera memories are FAT12,  FAT16, and current large devices are FAT32  Many hard drives are FAT16 or FAT32.  Free demo download

The CnW FAT recovery software will analyse and recover files from most disks that have been corrupted, or partially failed.  Deleted files can also be recovered, including ones on FAT32 disks which is a feature than many recovery programs fail on..

The screen is in two basic sections.  The top part gives the method of recovery, and the lower part gives details of each possible partition on a disk. For a very corrupted disk, or one with a corrupted boot sector, the recovery parameters may be entered by hand.

The recover options are as follows

• Full Recover.  This will read the disk in the same way the operating system does
• Recover from directory stubs.  In this mode, the program will scan the hard disk drive and find all existing directory stubs, ie clusters that contain directory information.  These directories are then read, and files recovered.  This will take care of situations when the root directory has been lost or totally erased.
• Recover from FAT.  This mode will find possible file starts in the FAT and recover the chain.  File names will be be known, but where possible file types will be determined.
• Full recover then from unused FAT.  In this mode all known files will be recovered, and then any remaining FAT entries will be processed

Used in conjunction with the above restore options, are various restore modes

• Overwrite existing files.  This will overwrite any existing file on the drive that data is being restored to.  Without this option, the file names are automatically incremented
• Restore deleted files. This is a mode where the program will attempt to restore a deleted file
• Ignore FAT.  If the File Allocation Table is missing, or corrupted, it may be ignored.  The program will assume that files are sequential, but on many disks, this will still produce an extremely high success rate.  Such a disk in a native PC would be unreadable.
• Recover slack space. This option will save all slack space fragments in files in a directory call slack - in the output directory selected for this job. Each file will be named sectxxxx where xxxx is the number of the first sector in the cluster that contains a partial file. The file will contain just the bytes in the slack section.  This option is normally only of interest for forensic investigation of disks.

Analyse disk parameters

Certain disks are unreadable because the start of the disk (or commonly, the memory chip) has been overwritten, or deleted etc.  In order to the program to recover data, it is necessary to determine the parameters should above, such as cluster size, directory start, cluster2 location.  The FATs are very useful, but may have also been deleted, so the location is not as important.  The disk analysis function will try and determine the values and will then display. If a recovery does not work, it may be necessary to check each value, and a bit of trial and error could be tried. For a well used disk, the analysis will very often produce accurate results, for a very empty disk, or memory chip with only one or two subdirectories, the results may be less reliable. The analysis works for FAT12, FAT16 and FAT32, but with FAT 32, the root directory is not in a fixed location and so may need manual adjustment.

Deleted Files

Deleted file recovery works with FAT disks by finding the directory entries that have been marked as deleted.  For FAT12 and FAT16, the directory stores the start of the file, and so if sequential, the file may be recovered.  For FAT32, the pointer to the file is a 32 bit value, and when deleted, the high 16 bits are zeroed, this makes recovery routines rather more complex.  CnW  has worked on analysis routines to overcome this problem for known file types, something that many other recovery programs fail to do.

Fragmented deleted files

When a FAT file is deleted, so are details of where it was stored.  If the file was sequential, then recovery is possible.  When a file was fragmented, basic recovery does not work as routines assume the file was sequential.  The process that CnW use smart data carving followed by processing of fragments.  Routines exist to process JPEG and several common video formats.  This is not an exact science so results are varied.  However, the results can be impressive and otherwise lost files can be recovered and read/displayed correctly.