Packages and Binaries:
fatcat is a tool to explore, extract, repair and forensic FAT filesystem. Its features: - Get information about FAT filesystem; - Explore FAT file system; - Read file or extract directories; - Retrieve file & directories that are deleted; - Backup & restore the FAT tables; - Hack the FAT table by writing on it; - Hack the entries by changing clusters and file sizes; - Perform a search for orphaned files & directories; - Compare and merge the FAT tables; - Repair unallocated directories & files; - Supports FAT12, FAT16 and FAT32.
How to install:
sudo apt install fatcat
FAT filesystem explore, extract, repair, and forensic tool
root@kali:~# fatcat -h fatcat v1.1.0, Gregwar <[email protected]> Usage: fatcat disk.img [options] -i: display information about disk -O [offset]: global offset (may be partition place) -F [format]: output format (default, json) Browsing & extracting: -l [dir]: list files and directories in the given path -L [cluster]: list files and directories in the given cluster -r [path]: reads the file given by the path -R [cluster]: reads the data from given cluster -s [size]: specify the size of data to read from the cluster -d: enable listing of deleted files -x [directory]: extract all files to a directory, deleted files included if -d will start with rootDirectory, unless -c is provided * -S: write scamble data in unallocated sectors * -z: write scamble data in unallocated sectors FAT Hacking -@ [cluster]: Get the cluster address and information -2: analysis & compare the 2 FATs -b [file]: backup the FATs (see -t) * -p [file]: restore (patch) the FATs (see -t) * -w [cluster] -v [value]: write next cluster (see -t) -t [table]: specify which table to write (0:both, 1:first, 2:second) * -m: merge the FATs -o: search for orphan files and directories * -f: try to fix reachable directories Entries hacking -e [path]: sets the entry to hack, combined with: * -c [cluster]: sets the entry cluster * -s [size]: sets the entry size * -a [attributes]: sets the entry attributes -k [cluster]: try to find an entry that point to that cluster *: These flags writes on the disk, and may damage it, be careful
Updated on: 2023-Mar-08