Home

With a FAT disk, the location of every cluster in a file is determined by the file allocation table.  There are in fact two such tables, and on a good disk, both tables will be identical.  The most common type of failure is for either sectors to fail, or parts of the table to be overwritten.  In these cases, the second table can be used.

An unusual failure is when sectors are partially corrupted, often by data bits failing, sometimes seen in memory sticks.  This can lead to an apparently good table, but one that is not possible to use.  The errors can cause the file to chain to incorrect sectors, or loop to a single cluster.

CnW Recovery software makes several tests on the FAT and will attempt to fix many possible errors.  Types of errors that are detected are as below

• Duplicate cluster values
• Variations between FAT1 and FAT2
• Clusters that point to themselves
• Cluster strings that do not terminate

The most common (default) fix for these errors is to set the pointer to the next cluster.  For a sequential file, this is the correct answer, but for a fragmented file, it is just possible that a fragment jump could be missed, though this would be a case of double bad luck.

For each change, an entry is made in the Forensic Report giving details of the modification.