|
|
|
|
|
|
FAT table is used for determination of condition of clusters and for searching next cluster of file or catalog.
One record about condition of cluster uses 4 bytes (32 bits) in FAT32.
The first sector of FAT32 table starts with signature F8 FF FF.
Free space is marked with signature 00 00 00 00. The end of the file is marked with signature FF FF FF F8 - FF FF FF FF. The damaged cluster is marked with signature FF FF FF F7 .
Searching for file tables using Hex Editor:
F8FFFF/h - put to find the first sector of FAT tables
01070000020700000307070000/h - put to find the 7th sector of FAT tables.
There is the special view of the first three sectors of FAT32 table on the picture above.
|
|
|
|
|
|
|
|
|
|
