views:

94

answers:

1

i was going through this link: FAT16 Basics to Assemble Clusters. I have read the structures involved in defining a directory entry in FAT. Now when giving the example for a FAT16 File, it says the data cluster is 0x03 for the example file MyFile.txt. Which means if we logically compute the Data Cluster we will be able to reach to the first node which happens to be cluster no 3.

But what I fail to understand is what the author is trying to say in the next line where it says

What we can see in the File Allocation Table at this moment?

How suddenly we reach to the File Allocation Table? Weren't we already there when we were going through the information of Myfile.txt? I couldn't find any reason how suddenly the author jumped to an offset location of 00000200 and is identifying the emptiness of the clusters. It will be great if someone can help me understand. Thanks

+1  A: 

The author tells you in the bullet points just below.

But the FAT starts at offset 0x0200, and since the file starts in the 3rd cluster and FAT16 cluster are two bytes (16 bits) in size, you start at offset 2 × 3, or 6.

On the drive, the allocated size is 32K, and the file size is > 32K × 3 but <= 32K × 4, the file will take four clusters, so the educated guess here during file recovery is that the eight bytes starting at offset six contain the four cluster numbers of the file.

lavinio
so the number 3 meant go to cluster 3 or read the (3*2) = 6th offset of FAT and the byte stored in it is the address of the first cluster to hold data, and then subsequently all the cluster in the squence can be obtained from there?
Anirudh Goel
Remember, FAT 16 means 16 bits (2 bytes) per entry. So you take the two bytes at offset six as the first cluster. Now, since this is recovery, and we're using a best-guess to find the remainder of the file, the author is _assuming_ that the next clusters in the file were at the next three positions (next 6 btyes), since they are unused after the deletion. We can't be sure, since the information was lost during deletion, but it's a reasonable guess and a best hope for recovery of the file.
lavinio