I spoke previously about the fat file system and how primarily it’s used with flash drives , camera memory cards and micro sd cards in phones see here. Today I want to talk about the need for raw data recovery on the above media where the fat file system has become corrupted and your files are not displayed. It’s easy to corrupt the fat file system if the 2 File allocation tables , which are at a fixed location at the start of the drive, have bad sectors . See image below We then need to perform a raw data recovery which means scanning the data area of the drive in a linear fashion from the start of the drive to the end. During the raw recovery process the software tools I use look for file signatures. A file signature is sequence of bytes at the start of the file which are identical for that particular file type ,eg a word document, and in addition we look for a sequence of bytes at or near the end of the file which are also identical.
Raw Recovery Software
There are 3 tools I prefer to use when performing raw data recoveries. R-Studio is my goto to tool for doing a raw recovery and you can view a complete list of File Types R-Studio can recover here. It is always a good idea to double check your results and I use Active File Recovery for this purpose as it can sometimes produce better results especially with jpgs. Open source software Photorec is very handy when you need to find a particular raw/file camera image format or a more obscure video format. A complete list of file types Photorec can discover can be found here. This tool has saved the day on numerous occasions and for an example see the following post
Creating Custom File Signatures
Occasionally I need to perform raw recoveries on media where the file type is not common and there is no built-in signature. So I will just talk about what is needed when this happens, R-Studio allows you to create your own signatures. I has it’s own built-in hex editors and tools to but I prefer to use a simple Hex Editor program and create the xml file R-Studio requires. The picture below is from a drafting package called Chief Architect and we will create a signature that R-Studio can use.
The picture below is of 2 chief architect plans tiled horizontally in a hex editor and what we are looking for here is a signature that is common to all Chief Architect files somewhere near the start of the file. In the image below we saw that there is a sequence of 16 bytes 48 bytes from the start of a plan file which are identical. You should examine more files than just 2 files but we will just examine 2 for today.
In the picture below we see are 2 Chief Architect plan files only now are looking for a signature that is common to all Chief Architect files somewhere near the end of the file. In the image below we saw that there is a sequence of 38 bytes from the end of a plan file which are identical.
The picture below is of an xml file which can be incorporated into R-Studio to be used by that program when performing a raw recovery and which will find chief architect plan files. See the following post for a successful recovery of Files using this method.
For more info on our deleted file recovery services.
Address
126 Whatley Crescent
