{"id":13389348,"url":"https://github.com/Gregwar/fatcat","last_synced_at":"2025-03-13T14:31:22.054Z","repository":{"id":11340190,"uuid":"13767727","full_name":"Gregwar/fatcat","owner":"Gregwar","description":"FAT filesystems explore, extract, repair, and forensic tool","archived":false,"fork":false,"pushed_at":"2024-01-24T15:38:22.000Z","size":213,"stargazers_count":297,"open_issues_count":27,"forks_count":44,"subscribers_count":11,"default_branch":"master","last_synced_at":"2024-07-31T13:15:03.761Z","etag":null,"topics":["cluster-number","disk","fat","fat-filesystems","fatcat","filesystem","forensics","orphaned-files","recovery","repair","sector","system"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Gregwar.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-10-22T08:53:45.000Z","updated_at":"2024-07-19T12:01:07.000Z","dependencies_parsed_at":"2023-02-10T07:31:20.213Z","dependency_job_id":"a741f71c-025d-4f12-bc7e-f0400189152b","html_url":"https://github.com/Gregwar/fatcat","commit_stats":{"total_commits":227,"total_committers":7,"mean_commits":32.42857142857143,"dds":"0.11894273127753308","last_synced_commit":"bfa9d0cffa6a7b39a11c88598a95bfd8da349236"},"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Gregwar%2Ffatcat","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Gregwar%2Ffatcat/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Gregwar%2Ffatcat/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Gregwar%2Ffatcat/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Gregwar","download_url":"https://codeload.github.com/Gregwar/fatcat/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221375043,"owners_count":16807954,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cluster-number","disk","fat","fat-filesystems","fatcat","filesystem","forensics","orphaned-files","recovery","repair","sector","system"],"created_at":"2024-07-30T13:01:07.120Z","updated_at":"2024-10-25T02:30:21.357Z","avatar_url":"https://github.com/Gregwar.png","language":"C++","readme":"# fatcat\n\n![fatcat](docs/fatcat.jpg)\n\nThis tool is designed to manipulate FAT filesystems, in order to\nexplore, extract, repair, recover and forensic them. It currently\nsupports FAT12, FAT16 and FAT32.\n\n[Tutorials \u0026 examples](docs/index.md)\n\n## Building and installing\n\nYou can build `fatcat` this way:\n\n```\nmkdir build\ncd build\ncmake ..\nmake\n```\n\nAnd then install it:\n\n```\nmake install\n```\n\n## Exploring\n\n### Using fatcat\n\nFatcat takes an image as argument:\n\n```\nfatcat disk.img [options]\n```\n\n**NOTE: according to your build, you might have to specify options before ``disk.img``, i.e\n``fatcat [options] disk.img``**\n\nYou can specify an offset in the file with `-O`, this could be useful if there is \nmultiple partitions on a block devices, for instance:\n\n```\nfatcat disk.img -O 1048576 [options]\n```\n\nThis will tell fatcat to begin on the 1048576th byte. Have a look to the [partition tutorial](docs/partition.md).\n\n### Listing\n\nYou can explore the FAT partition using `-l` option like this:\n\n```\n$ fatcat disk.img -l /\nListing path /\nCluster: 2\nd 24/10/2013 12:06:00  some_directory/                c=4661\nd 24/10/2013 12:06:02  other_directory/               c=4662\nf 24/10/2013 12:06:40  picture.jpg                    c=4672 s=532480 (520K)\nf 24/10/2013 12:06:06  hello.txt                      c=4671 s=13 (13B)\n```\n\nYou can also provide a path like `-l /some/directory`.\n\nUsing `-L`, you can provide a cluster number instead of a path, this may\nbe useful sometime.\n\nIf you add `-d`, you will also see deleted files.\n\nIn the listing, the prefix is `f` or `d` to tell if the line concerns a file or\na directory.\n\nThe `c=` indicates the cluster number, `s=` indicates the site in bytes (which\nshould be the same as the pretty size just after).\n\nThe `h` letter at the end indicates that the file is supposed to be hidden.\n\nThe `d` letter at the end indicates that the file was deleted.\n\n### Reading a file\n\nYou can read a file using `-r`, the file will be wrote on the standard\noutput:\n\n```\n$ fatcat disk.img -r /hello.txt\nHello world!\n$ fatcat disk.img -r /picture.jpg \u003e save.jpg\n```\n\nUsing `-R`, you can provide a cluster number instead of a path, but the file size\ninformation will be lost and the file will be rounded to the number of clusters\nit fits, unless you provide the `-s` option to specify the file size to read.\n\nYou can use `-x` to extract the FAT filesystem directories to a directory:\n\n```\nfatcat disk.img -x output/\n```\n\nIf you want to extract from a certain cluster, provide it with `-c`.\n\nIf you provide `-d` to extract, deleted files will be extracted too.\n\n## Undelete\n\n### Browsing deleted files \u0026 directories\n\nAs explaines above, deleted files can be found in listing by providing `-d`:\n\n```\n$ fatcat disk.img -l / -d\nf 24/10/2013 12:13:24  delete_me.txt                  c=5764 s=16 (16B) d\n```\n\nYou can explore and spot a file or an interesting deleted directory.\n\n### Retrieving deleted file\n\nTo retrieve a deleted file, simply use `-r` to read it. Note that the produced\nfile will be read contiguously from the original FAT system and may be broken.\n\n### Retreiving deleted directory\n\nTo retrieve a deleted directory, note its cluster number and extract it like above:\n\n```\n# If your deleted directory cluster is 71829\nfatcat disk.img -x output/ -c 71829\n```\n\nSee also: [undelete tutorial](docs/undelete.md)\n\n## Recover\n\n### Damaged file system\n\nAssuming your disk has broken sectors, you may want to do recovering on it.\n\nThe first advice is to make a copy of your data using `ddrescue`, and save your disk\nto another one or into a sane file.\n\nWhen sectors are broken, their bytes will be replaced with `0`s in the `ddrescue` image.\n\nA first way to go is trying to explore your image using `-l` as above and check `-i` to\nfind out if `fatcat` recognizes the disk as a FAT system.\n\nThen, you can try to have a look at `-2`, to check if the file allocation tables differs,\nand if it looks mergeable. It is very likely that is will be mergeable, in this case, you\ncan try `-m` to merge the FAT tables, don't forget to backup it before (see below).\n\n### Orphan files\n\nWhen your filesystem is broken, there are files and lost files and lost directories that\nwe call \"orphaned\", because you can't reach them from the normal system.\n\n`fatcat` provides you an option to find those nodes, it will do an automated analysis of your\nsystem and explore allocated sectors of your filesystem, this is done with `-o`.\n\nYou will get a list of directories and files, like this:\n\n```\nThere is 2 orphaned elements:\nDirectory clusters 4592 to 4592: 2 elements, 49B\nFile clusters 4611 to 4611: ~512B\n```\n\nYou can then use directly `-L` and `-R` to have a look into those files and directories:\n\n```\n$ fatcat disk.img -L 4592\nListing cluster 4592\nCluster: 4592\nd 23/10/2013 17:45:06  ./                             c=4592\nd 23/10/2013 17:45:06  ../                            c=0\nf 23/10/2013 17:45:22  poor_orphan.txt                c=4601 s=49 (49B)\n```\n\nNote that orphan files have an unknown size, this mean that if you read it, you will get\na file that is a multiple of the cluster sizes.\n\nSee also: [orphaned files tutorial](docs/orphan.md)\n\n## Hacking\n\nYou can use `fatcat` to hack your FAT filesystem\n\n### Informations\n\nThe `-i` flag will provide you a lot of information about the filesystem:\n\n```\nfatcat disk.img -i\n```\n\nThis will give you headers data like sectors sizes, fats sites, disk label etc. It\nwill also read the FAT table to estimate the usage of the disk.\n\nYou can also get information about a specific cluster by using `-@`:\n\n```\nfatcat disk.img -@ 1384\n```\n\nThis will give you the cluster address (offset of the cluster in the filesystem)\nand the value of the next cluster in the two FAT tables.\n\n### Backuping \u0026 restoring FAT\n\nYou can use `-b` to backup your FAT tables:\n\n```\nfatcat disk.img -b backup.fats\n```\n\nAnd use `-p` to write it back:\n\n```\nfatcat disk.img -p backup.fats\n```\n\n### Writing to the FATs\n\nYou can write to the FAT tables with `-w` and `-v`:\n\n```\nfatcat disk.img -w 123 -v 124\n```\n\nThis will write `124` as value of the next cluster of `123`.\n\nYou can also choose the table with `-t`, 0 is both tables, 1 is the first and 2 the second.\n\n### Diff \u0026 merge the FATs\n\nYou can have a look at the diff of the two FATs by using `-2`:\n\n```\n# Watching the diff\n$ fatcat disk.img -2\nComparing the FATs\n\nFATs are exactly equals\n\n# Writing 123 in the 500th cluster only in FAT1\n$ fatcat disk.img -w 500 -v 123 -t 1\nWriting next cluster of 500 from 0 to 123\nWriting on FAT1\n\n# Watching the diff\n$ fatcat disk.img -2\nComparing the FATs\n[000001f4] 1:0000007b 2:00000000\n\nFATs differs\nIt seems mergeable\n```\n\nYou can merge two FATs using `-m`. For each different entries in the table,\nif one is zero and not the other, the non-zero file will be choosen:\n\n```\n$ fatcat disk.img -m\nBegining the merge...\nMerging cluster 500\nMerge complete, 1 clusters merged\n```\n\nSee also: [fixing fat tutorial](docs/fat.md)\n\n### Directories fixing\n\nFatcat can fix directories having broken FAT chaining.\n\nTo do this, use `-f`. All the filesystem tree will be walked and the directories\nthat are unallocated in the FAT but that fatcat can read will be fixed in the FAT.\n\n### Entries hacking\n\nYou can have information about an entry with `-e`:\n\n```\nfatcat disk.img -e /hello.txt\n```\n\nThis will display the address of the entry (not the file itself), the cluster reference\nand the file size (if not a directory).\n\nYou can add the flag `-c [cluster]` to change the cluster of the entry and the flag\n`-s [size]` to change the entry size.\n\nSee also: [fun with fat tutorial](docs/fun-with-fat.md)\n\nYou can use `-k` to search for a cluster reference.\n\n### Erasing unallocated files\n\nYou can erase unallocated sectors data, with zeroes using `-z`, or using\nrandom data using `-S`.\n\nFor instance, deleted files will then become unreadables.\n\n## LICENSE\n\nThis is under MIT license\n","funding_links":[],"categories":["C++","C++ (225)"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGregwar%2Ffatcat","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FGregwar%2Ffatcat","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGregwar%2Ffatcat/lists"}