index.md

fatcat tutorials & examples

Here is a documentation that will inform you about FAT filesystems, and explain how you can use the fatcat tool to forensic, repair, undelete and hack FAT:

• FAT repair guide
• Use fatcat with a partitionned disk
• Undelete tutorial: how to revive deleted files
• FAT table tutorial: how to fix damaged table
• Orphan tutorial: how to recover lost files and directories
• Fun with FAT: fun filesystem hackings

Images

You can find prebuilt images in images/ directory:

• empty.img: an empty FAT32 filesystem
• hello-world.img: a simple image with txt files and a directory
• deleted.img: an image containing a directory and a file that was both deleted
• directory-loop.img: an image with looping directories
• infinite-file.img: a file which is looping and with maximum FAT32 size (4G the image is just 50M)
• full-fat.img: an image with a full FAT, the disk appear full even if you can't see any file in it
• two-file-same-cluster.img: an image with two files having different names pointing to the same cluster. If you change one, the other will be changed too (note that your OS may cache some data).
• fake-big-disk-1T.img: an image with fake values in the FAT32 headers, so that your system may behaves like you have a 1T disk, even if it's smaller. You can read & write files on it until you'll reach the actual size of your disk.
• repair.img: an image that you can repair to test the fatcat options. it contains a directory that is unallocated in FAT1 (can be merged with FAT2 using -m), a directory that is unallocated (can be fixed with -f), and an orphan directory (can be found using -o, see orphaned tutorial). Have a look to the repair guide.