How can I write a program that can recover files in FAT32

Question

How can I write a program that can recover files in FAT32?

Answer 1

This is pretty complex, but FAT32 is very good documented:

I wrote a tool for direct FAT32 access once using only those ressources:

• http://en.wikipedia.org/wiki/File_Allocation_Table

• http://support.microsoft.com/kb/154997/

• http://www.microsoft.com/whdc/system/platform/firmware/fatgen.mspx

But I've never actually tried to recover files. If you will successfully recover a file depends on several factors:

1. The file must still "exist" physically on the hard disk
2. You must know where the file starts
3. You must know what you are looking for (Headers..)

Answer 2

It depends on what happened to the files you're trying to recover. The data may still be on the partition, or it could be overwritten by now. There are a lot of pre-written solutions. A simple google search should give you a plethora of software that can try to recover the data, but it's not 100% sure to get them back. If you really want to recover them yourself, you'll need to write something the read the raw partition and ignore missing file markers.

here is a program (written by Thomas Tempelman. This guy is great.) that might help you out. You can make a copy of the partition, ignoring corrupt bits, then operate on the copy so you don't mess anything up, and you may also be able to recover the data directly with it.

Answer 3

I think you are referring to data carving, that is, reading the physical device and reconstructing previously unlinked files based on some knowledge (e.g. when you find two letters, PK, it's highly probable than a zip archive is following, same for JFIF for JPEG).

In this case, I suggest you to study the source code of PhotoRec a great (in my opinion, the best) Open Source tool for data carving.