Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

General Discussion: Fat32 data recovery

$
0
0
Well, no. Meaning that if you partition/format under different OS the values in the BPB may be different, but they are usually "predictable" (for the given OS) Quote:: the first entry is 0x0ffffff8) the second and third entries are end of file markers (0x0fffffff) Yes and no, meaning that the 2nd is a "default" and "fixed" (at formatting time ONLY) EOF, the third is actually a EOF marker. What happens if on a freshly formatted FAT32 filesystem you create a directory (or more than one) in ROOT? Does the 2nd entry remain always FFFFFFF0 when you add (or delete) files and directories? Is the behaviour the "same" if the disk is a "removable" device (such as I presume is now your USB stick) or if it is a partition on a "fixed" device? Which text books are you reading? Why don't you try something "from the mouth of the wolf"? http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fatgen103.doc jaclaz

Viewing all articles
Browse latest Browse all 20102

Trending Articles