Joined: 09 Dec 2008 Posts: 1051 Location: RecoverMyFlashDrive.com Fairfield, CT, USA
Posted: Fri Aug 14, 2009 9:08 Post subject: How To Rebuild FAT32 Boot Record
In some cases the block containing the FAT boot record may be damaged, if one of the FAT tables is present you can manually enter the FAT boot record values into Image Explorer or Flash Explorer to retrieve the data.
First create a bogus FAT32 (or FAT16) entry. MBR->Properties
Then goto FAT32->Properties
FAT1 & FAT2:
Locate a working copy of the FAT table and put its address in FAT1 and FAT2
tip: search for f8ffff/h/512/0
Claster_Size:
Values are powers of two (ie: 32, 64, 128, etc), to find the value use check_dirs. The correct value will have the same offset for all Diff’s. An incorrect value will have different values for all Diffs.
Claster_Size: 32 = BAD
Code:
Dir 0x00600000 Must be 0x008fc000 Diff- 0x002fc000 Cluster 0x000043
Dir 0x00608000 Must be 0x00900000 Diff- 0x002f8000 Cluster 0x000044
Dir 0x00610000 Must be 0x00904000 Diff- 0x002f4000 Cluster 0x000045
Claster_Size: 64 = GOOD
Code:
Dir 0x00600000 Must be 0x00a08000 Diff- 0x00408000 Cluster 0x000043
Dir 0x00608000 Must be 0x00a10000 Diff- 0x00408000 Cluster 0x000044
Dir 0x00610000 Must be 0x00a18000 Diff- 0x00408000 Cluster 0x000045
Claster_0:
To find the value set Claster_0 to 0x0 and run check_dirs. The Diff value is Claster_0.
Code:
Dir 0x00600000 Must be 0x00218000 Diff+ 0x003e8000 Cluster 0x000043
Dir 0x00608000 Must be 0x00220000 Diff+ 0x003e8000 Cluster 0x000044
Dir 0x00610000 Must be 0x00228000 Diff+ 0x003e8000 Cluster 0x000045
Clasters
To find the number of clusters in the image use the following:
(size of image - Claster_0) / 512 / Claster_Size
Root Claster
Cluster containing the root directory.
FAT32: The default value is 0x2, Start from Claster_0 and look for the next sector containing data or a directory table. Subtract that value from Claster_0,divide by 512, then divide by Claster_Size
