{"id":22796422,"url":"https://github.com/macmade/fatdump","last_synced_at":"2025-04-19T13:09:08.421Z","repository":{"id":27915587,"uuid":"31407600","full_name":"macmade/fatdump","owner":"macmade","description":"A command line tool to extract data from FAT disk images.","archived":false,"fork":false,"pushed_at":"2021-08-02T22:58:19.000Z","size":124,"stargazers_count":11,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2024-07-30T18:07:19.457Z","etag":null,"topics":["c","command-line","command-line-tool","disk","disk-format","disk-image","dump","fat","filesystem"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/macmade.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-02-27T07:03:25.000Z","updated_at":"2024-03-25T12:21:04.000Z","dependencies_parsed_at":"2022-07-19T01:47:28.772Z","dependency_job_id":null,"html_url":"https://github.com/macmade/fatdump","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/macmade%2Ffatdump","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/macmade%2Ffatdump/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/macmade%2Ffatdump/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/macmade%2Ffatdump/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/macmade","download_url":"https://codeload.github.com/macmade/fatdump/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":229333154,"owners_count":18056671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["c","command-line","command-line-tool","disk","disk-format","disk-image","dump","fat","filesystem"],"created_at":"2024-12-12T05:12:56.812Z","updated_at":"2024-12-12T05:12:57.413Z","avatar_url":"https://github.com/macmade.png","language":"C","funding_links":["https://patreon.com/macmade","https://paypal.me/xslabs"],"categories":[],"sub_categories":[],"readme":"fatdump\n=======\n\n[![Build Status](https://img.shields.io/travis/macmade/fatdump.svg?branch=master\u0026style=flat)](https://travis-ci.org/macmade/fatdump)\n[![Issues](http://img.shields.io/github/issues/macmade/fatdump.svg?style=flat)](https://github.com/macmade/fatdump/issues)\n![Status](https://img.shields.io/badge/status-active-brightgreen.svg?style=flat)\n![License](https://img.shields.io/badge/license-bsd-brightgreen.svg?style=flat)\n[![Contact](https://img.shields.io/badge/contact-@macmade-blue.svg?style=flat)](https://twitter.com/macmade)  \n[![Donate-Patreon](https://img.shields.io/badge/donate-patreon-yellow.svg?style=flat)](https://patreon.com/macmade)\n[![Donate-Gratipay](https://img.shields.io/badge/donate-gratipay-yellow.svg?style=flat)](https://www.gratipay.com/macmade)\n[![Donate-Paypal](https://img.shields.io/badge/donate-paypal-yellow.svg?style=flat)](https://paypal.me/xslabs)\n\nAbout\n-----\n\nfatdump is a command line tool to extract data from FAT disk images.\n\nUsage\n-----\n\n    fatdump [OPTIONS] IMAGE\n    \n    Options\n    \n        --mbr      Prints MBR infos\n        --mbr-raw  Prints raw MBR data\n        --fat      Prints FAT infos\n        --fat-raw  Prints raw FAT data\n        --dir      Prints root directory infos\n        --dir-raw  Prints raw root directory data\n        --hidden   Displays hidden file and folders\n        --deleted  Displays deleted file and folders\n        --data     Displays raw data for files\n        --extract  Extract files in the current directory\n        -h         Prints this help message\n    \n    Example:\n    \n        fatdump --hidden --deleted fat-disk.img\n\nExtracting files\n----------------\n\nAll files can be extracted in the current working directory using the `--extract` option.\n\nNote that hidden files can be extracted with the `--hidden` option, as well as deleted files with the `--deleted` option.  \nThis can be useful for data-recovery or forensics.\n\nExample output\n--------------\n\nBy default, `fatdump` will only display the FAT volume's hierarchy:\n\n    $ fatdump disk.img\n    -----------------------------------\n    Files in volume: TEST       \n    -----------------------------------\n    [+] SUBDIR\n     |  [+] .\n     |  [+] ..\n     |   |- A.TXT \u003c7 bytes\u003e\n     |   |- B.TXT \u003c12 bytes\u003e\n     |  [+] SUBSUB\n     |   |  [+] .\n     |   |  [+] ..\n     |   |   |- A.TXT \u003c7 bytes\u003e\n     |   |- C.TXT \u003c12 bytes\u003e\n     |- A.TXT \u003c7 bytes\u003e\n    [+] SUBDIR2\n     |  [+] .\n     |  [+] ..\n     |   |- A.TXT \u003c7 bytes\u003e\n    -----------------------------------\n\nFile's data can be displayed with the `--data` option.  \nNote that hidden files can be displayed as well with the `--hidden` option, as well as deleted files with the `--deleted` option.  \n\n    $ fatdump --data disk.img\n    ----------------------------------------------------------------------------------------------------------------------\n    Data for file: /LOREM.TXT - 543 bytes\n    ----------------------------------------------------------------------------------------------------------------------\n    4C 6F 72 65 6D 20 69 70 73 75 6D 20 64 6F 6C 6F 72 20 73 69 74 20 61 6D 65 74 2C 20 63 | Lorem.ipsum.dolor.sit.amet,.c\n    6F 6E 73 65 63 74 65 74 75 65 72 20 61 64 69 70 69 73 63 69 6E 67 20 65 6C 69 74 2C 20 | onsectetuer.adipiscing.elit,.\n    73 65 64 20 64 69 61 6D 20 6E 6F 6E 75 6D 6D 79 20 6E 69 62 68 20 65 75 69 73 6D 6F 64 | sed.diam.nonummy.nibh.euismod\n    20 74 69 6E 63 69 64 75 6E 74 20 75 74 20 6C 61 6F 72 65 65 74 20 64 6F 6C 6F 72 65 20 | .tincidunt.ut.laoreet.dolore.\n    6D 61 67 6E 61 20 61 6C 69 71 75 61 6D 20 65 72 61 74 20 76 6F 6C 75 74 70 61 74 2E 20 | magna.aliquam.erat.volutpat..\n    55 74 20 77 69 73 69 20 65 6E 69 6D 20 61 64 20 6D 69 6E 69 6D 20 76 65 6E 69 61 6D 2C | Ut.wisi.enim.ad.minim.veniam,\n    ----------------------------------------------------------------------------------------------------------------------\n\nThe MBR infos can be displayed with the `--mbr` option:\n    \n    $ fatdump --mbr disk.img\n    -----------------------------------------\n    MBR:\n    -----------------------------------------\n    - OEM ID:                  BSD  4.4\n    - Bytes per sector:        512\n    - Sectors per cluster:     2\n    - Reserved sectors:        1\n    - Number of FATs:          2\n    - Max root dir entries:    512\n    - Total sectors:           28799\n    - Media descriptor:        0xF8\n    - Sectors per FAT:         56\n    - Sectors per track:       32\n    - Heads per cylinder:      16\n    - Hidden sectors:          1\n    - LBA sectors:             0\n    - Drive number:            0x80\n    - Extended boot signature: 0x29\n    - Volume serial number:    0x3D480BFD\n    - Volume label:            TEST       \n    - File system:             FAT16   \n    - Bootable:                yes\n    -----------------------------------------\n    \nRaw data for the MBR can be displayed with the `--mbr-raw` option:\n\n    $ fatdump --mbr-raw disk.img\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    MBR raw data:\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    EB 3C 90 42 53 44 20 20 34 2E 34 00 02 02 01 00 02 00 02 7F 70 F8 38 00 20 00 10 00 01 00 00 00 00 00 00 00 80 00 | .\u003c.BSD..4.4.........p.8...............\n    29 FD 0B 48 3D 54 45 53 54 20 20 20 20 20 20 20 46 41 54 31 36 20 20 20 FA 31 C0 8E D0 BC 00 7C FB 8E D8 E8 00 00 | )..H=TEST.......FAT16....1.....|......\n    5E 83 C6 19 BB 07 00 FC AC 84 C0 74 06 B4 0E CD 10 EB F5 30 E4 CD 16 CD 19 0D 0A 4E 6F 6E 2D 73 79 73 74 65 6D 20 | ^..........t.......0.......Non-system.\n    64 69 73 6B 0D 0A 50 72 65 73 73 20 61 6E 79 20 6B 65 79 20 74 6F 20 72 65 62 6F 6F 74 0D 0A 00 00 00 00 00 00 00 | disk..Press.any.key.to.reboot.........\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ......................................\n    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA                                                             | ................U.\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    \nThe File Allocation Table can be displayed with the `--fat` option (`--fat-raw` for the raw FAT data):\n    \n    $ fatdump --fat disk.img\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    FAT:\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n           0: Last   |        1: Last   |        2: Last   |        3: 0x0004 |        4: 0x0005 |        5: 0x0006 |        6: Last   |        7: Free  \n           8: Free   |        9: Last   |       10: Free   |       11: Free   |       12: Free   |       13: Free   |       14: Free   |       15: Last  \n          16: 0x0011 |       17: 0x0012 |       18: 0x0013 |       19: Last   |       20: Last   |       21: 0x0016 |       22: 0x0017 |       23: 0x0018\n          24: Last   |       25: Last   |       26: Free   |       27: 0x001C |       28: 0x001D |       29: 0x001E |       30: Last   |       31: Last  \n          32: Free   |       33: Free   |       34: Free   |       35: Free   |       36: Free   |       37: Free   |       38: 0x0027 |       39: 0x0028\n          40: 0x0029 |       41: Last   |       42: Last   |       43: 0x002C |       44: 0x002D |       45: 0x002E |       46: Last   |       47: 0x0030\n          48: 0x0031 |       49: 0x0032 |       50: Last   |       51: Last   |       52: Last   |       53: Last   |       54: Last   |       55: 0x0038\n          56: 0x0039 |       57: 0x003A |       58: Last   |       59: Last   |       60: 0x003D |       61: 0x003E |       62: 0x003F |       63: Last   \n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    \n    \n    \nThe volume's root directory can be displayed with the `--dir` option (`--dir-raw` for the raw directory data):\n\n    $ fatdump --dir disk.img\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    Root directory:\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    1   : TEST                                         | 2   : LFN                                          | 3   : ~1      TRA                                 \n        - Size:                    0                   | .................................................. |     - Size:                    4096               \n        - Cluster:                 0                   | .................................................. |     - Cluster:                 3                  \n        - Creation time:           -                   | .................................................. |     - Creation time:           2015/02/26 04:31:18\n        - Last access time:        -                   | .................................................. |     - Last access time:        2015/02/26 00:00:00\n        - Last modification time:  2015/02/26 04:40:22 | .................................................. |     - Last modification time:  2015/02/26 04:31:18\n        - Read-only:               no                  | .................................................. |     - Read-only:               no                 \n        - Hidden:                  no                  | .................................................. |     - Hidden:                  yes                \n        - System:                  no                  | .................................................. |     - System:                  no                 \n        - Volume ID:               yes                 | .................................................. |     - Volume ID:               no                 \n        - Directory:               no                  | .................................................. |     - Directory:               no                 \n        - Archive:                 yes                 | .................................................. |     - Archive:                 yes                \n        - LFN:                     no                  | .................................................. |     - LFN:                     no                 \n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    4   : SUBDIR                                       | 5   : LFN                                          | 6   : TRASHE~1                                    \n        - Size:                    0                   | .................................................. |     - Size:                    0                  \n        - Cluster:                 9                   | .................................................. |     - Cluster:                 2                  \n        - Creation time:           2015/02/26 04:31:30 | .................................................. |     - Creation time:           2015/02/26 04:31:18\n        - Last access time:        2015/02/26 00:00:00 | .................................................. |     - Last access time:        2015/02/26 00:00:00\n        - Last modification time:  2015/02/26 04:31:30 | .................................................. |     - Last modification time:  2015/02/26 04:31:18\n        - Read-only:               no                  | .................................................. |     - Read-only:               no                 \n        - Hidden:                  no                  | .................................................. |     - Hidden:                  yes                \n        - System:                  no                  | .................................................. |     - System:                  no                 \n        - Volume ID:               no                  | .................................................. |     - Volume ID:               no                 \n        - Directory:               yes                 | .................................................. |     - Directory:               yes                \n        - Archive:                 no                  | .................................................. |     - Archive:                 no                 \n        - LFN:                     no                  | .................................................. |     - LFN:                     no                 \n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n    12  : A       TXT                                  | 506 : Free                                         | 507 : Free                                        \n        - Size:                    7                   | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Cluster:                 31                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Creation time:           2015/02/16 03:34:32 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Last access time:        2015/02/26 00:00:00 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Last modification time:  2015/02/26 04:31:54 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Read-only:               no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Hidden:                  no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - System:                  no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Volume ID:               no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Directory:               no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - Archive:                 yes                 | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n        - LFN:                     no                  | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\n    ------------------------------------------------------------------------------------------------------------------------------------------------------------\n\nLicense\n-------\n\nfatdump is released under the terms of the BSD License.\n\nRepository Infos\n----------------\n\n    Owner:\t\t\tJean-David Gadina - XS-Labs\n    Web:\t\t\twww.xs-labs.com\n    Blog:\t\t\twww.noxeos.com\n    Twitter:\t\t@macmade\n    GitHub:\t\t\tgithub.com/macmade\n    LinkedIn:\t\tch.linkedin.com/in/macmade/\n    StackOverflow:\tstackoverflow.com/users/182676/macmade\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmacmade%2Ffatdump","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmacmade%2Ffatdump","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmacmade%2Ffatdump/lists"}