Data Protection and Recovery Techniques Part 6: Recovering Data Without Help from the FAT Learn how to identify and restore files on a disk with a missing or damaged file allocation table (FAT)
Data Protection and Recovery Techniques Part 6: Recovering Data Without Help
from the FAT
Learn how to identify and restore files on a disk with a missing or damaged
file allocation table (FAT)
Introduction
In Part 5 of this series, I described the process of locating the contents of an erased file on a FAT-based hard disk and writing its contents to a new file on another drive using Norton Disk Editor. As you can see from reviewing that article, the process is relatively simple if the file allocation table, or FAT, is intact. However, what if the FAT has been erased or damaged? In this article, you will learn how to retrieve data even when the FAT cannot be used to track down the locations of a files clusters. As Ive stressed before, this process is much more successful if you defragment your drives frequently.
Pattern Recognition Is the Key to Locating Lost Data
Professional data recovery programs such as Ontrack Easy Recovery Professional and data-recovery technicians working for companies like Ontrack and others can bypass a damaged or missing FAT and recover data directly from the drive. Whats their secret? They know how to distinguish the unique byte patterns that indicate the beginning and end of particular types of files. This information, often referred to as file signatures, enables data recovery professionals to recover lost data from a drive whether the FAT is valid, damaged, or missing. For example, Ontrack Easy Recovery Professional version 6 is designed to recover over 200 different types of files. Do you need to understand the structure of that many types of files? Probably not, but by using Norton Disk Editor and data files from the applications you use every day, you can create your own database of distinguishing file characteristics.
Creating a Sampler of File Types
To create a sampler of file types you can use for research, its best to use an empty hard disk drive letter. If you dont have a spare hard disk letter, but you have unpartitioned space on your hard disk, create a new partition, set it up as an extended partition and format it as a logical drive with the FAT file system (FAT16 or FAT32). If you have Norton Utilities or Norton System Works, use the WipeInfo utility to clear all empty space before you copy files to the drive; note that WipeInfo offers the clear empty space option under Windows 9x/Me only.
If you dont have empty disk space you can use for this task, you can install a new hard disk; if the drive is a used one, use the utility software provided by the drive vendor to write zeroes to the drive to remove any trace of old data from the drive. The goal is to create a completely clean disk without any extraneous information where you can store and analyze file signatures.
Once you have selected where to store files, use your favorite applications to store files on this drive, or copy existing files to the drive. Since youre storing data to a newly-created or newly-formatted drive, the data will be stored without fragmentation, and the beginning and end of each file will be easier to distinguish.
Using Norton Disk Editor to Analyze Data File Signatures
Once you have created three or four different files of each file type you want to research with your favorite applications, you can use Norton Disk Editor to locate the beginning and end of each file to determine each filetypes distinctive signature. Follow this process (see Part 5 of this series for details):
- Restart the computer with a DOS boot disk or with Windows 9x/Me (Disk Editor cant be run under Windows NT/2000/XP, even in Read-only mode)
- Start Disk Editor
- Select the file from the File menu
- Note the hex and text characters used at the beginning and end of the file (Figure 1).
| Figure 1 |
| The start (1) and end (2) of an Adobe Acrobat (.PDF) file created with Acrobat 4. |
If you use Windows 9x/Me, you can run Disk Editor from within the Windows GUI in Read-only mode in a window, and use Windows to copy hex characters from the start of the file into a Notepad window to create your own database. This is the method I used to create the information in the following table, which lists typical bytes at the start and end for a few of the most popular applications in use today as shown in the Norton Disk Editor in hex mode.
As Figure 1 shows, when Norton Disk Editor is set to display in Hex mode, text characters are shown at the right side of the main display. In Table 1, I have highlighted text characters at the start of a typical file in yellow and text characters at the end of a typical file in green. If you are scanning through a drive looking for the beginning or end of a file, you might find text easier to spot than hex characters. Note that while the first characters of a particular file type are often similar or identical, the end of a data file isnt always as consistent.
Table 1 Typical Starting and Ending Bytes for Popular File Types
|
Filetype |
Typical Starting Bytes (Hex) |
Text Char |
|
Rich Text .RTF |
7B 5C 72 74 66 31 5C 61 - 6E 73 69 5C 61 6E 73 69 or 7B 5C 72 74 66 31 5C 61 - 6E 73 69 20 5C 64 65 66 0D 0A 5C 70 61 72 20 7D 7D 00 or 5C 70 61 72 20 7D 00 or 5C 70 61 72 0D 0A 7D 7D 00 |
{\rtf1\ansi\ansi {\rtf1\ansi \def \par }} \par } \par }} |
|
MS Word XP/2000 |
D0 CF 11 E0 A1 B1 1A E1 - 00 00 00 00 00 00 00 00 72 64 44 6F 63 00 10 00 - 00 00 57 6F 72 64 2E 44 6F 63 75 6D 65 6E 74 2E - 38 00 F4 39 B2 71 00 00 |
Word.Document |
|
MS Word 6/WordPad |
D0 CF 11 E0 A1 B1 1A E1 - 00 00 00 00 00 00 00 00 (may contain Word.Document as in MS Word XP/2000) |
|
|
Microsoft Excel .XLS |
D0 CF 11 E0 A1 B1 1A E1 - 00 00 00 00 00 00 00 00 (may contain user names near end of file) |
|
|
Microsoft PowerPoint .PPT |
D0 CF 11 E0 A1 B1 1A E1 - 00 00 00 00 00 00 00 00 (varies) |
|
|
Adobe Photoshop 7 .PSD |
38 42 50 53 00 01 00 00 - 00 00 00 00 00 03 00 00 (varies; files often end with groups of alternating characters) |
8BPS. |
|
TIFF |
49 49 2A 00 1F 43 03 00 (remainder varies) (varies) |
II*. |
|
JPEG |
FF D8 FF E0 00 10 4A 46 - 49 46 00 01 (rest of first line varies) FF D9 00 |
JFIF |
|
JPEG (Nikon Coolpix 995) |
FF D8 FF E1 88 45 45 78 - 69 66 00 00 49 49 2A 00 FF D9 00 00 |
EEXIF |
|
JPEG (Kodak DC3400) |
FF D8 FF E1 18 11 45 78 - 69 66 00 00 4D 4D 00 2A FF D9 00 00 |
EXIF |
|
GIF |
47 49 46 38 39 61 (remainder varies) 00 3B 00 |
GIF89a .;. |
|
Windows Bitmap |
42 4D (remainder varies) (end of file often contains large block of repeating or alternating characters until end of sector or cluster) |
BM |
|
Adobe Acrobat 3 |
25 50 44 46 2D 31 2E 32 - 20 0D 0A 25 E2 E3 CF D3 25 25 45 4F 46 0D 0A 00 00 00 00 00 00 |
%PDF-1.2 %%EOF |
|
Adobe Acrobat 4 |
25 50 44 46 2D 31 2E 33 - 0D 25 E2 E3 CF D3 0D 0A 25 25 45 4F 46 0D 00 00 00 00 00 |
%PDF-1.3 %%EOF |
|
Adobe Acrobat 5 |
25 50 44 46 2D 31 2E 34 - 0D 25 E2 E3 CF D3 0D 0A 62 62 37 31 3E 5D 0D 3E - 3E 0D 73 74 61 72 74 78 72 65 66 0D 31 37 33 0D - 25 25 45 4F 46 0D 00 00 |
%PDF-1.4 %%EOF |
|
Windows Metafile |
D7 CD C6 9A 00 00 (rest of first line might vary) (varies look for 03 followed by 00s at end of file) |
|
|
Quattro Pro |
D0 CF 11 E0 A1 B1 1A E1 - 00 00 00 00 00 00 00 00 (varies) |
|
|
Paintbrush .PCX |
0A 05 01 08 (remainder varies) (varies) |
How can you use the information in Table 1 and the similar database you make of your own files to help you recover lost data? If the file allocation table (FAT) on a drive is lost because the drive was formatted or partitioned, you can use Disk Editor to search for the hex characters, which are found at the start of each file. Specify the first few characters, or the ones highlighted in yellow for best results. These characters should be located at the start of a disk cluster; if they are located elsewhere, they might be leftover junk data. Note the cluster and sector numbers.
To locate the end of the file, search for the green-highlighted characters (in text or hex mode) or for repeating characters followed by several 00 hex or period (.) text characters. Note the sector number. Then, use the method outlined in Part 5 of this series to write the specified sectors to a file on another drive.
The list of file characteristics in Table 1 isnt intended to be comprehensive, but it does give you an idea of the wide variety of data files in use. If you want to pursue data recovery with Norton Disk Editor or a similar tool, you will find that getting familiar with the types of files you create makes locating the start and end of a lost file much easier.
Tips
In most cases, repeated 00 characters (in hex) or periods (.) in text mode indicate the end of a file, particularly on a clean drive.
If you have a difficult time determining the end of the file, specify different ranges of sectors and write them to different filenames, then open or view them to determine which ones contain the data you want.
As you saw in Table 1, some data file types have distinctive end-of-file patterns. As you work with your own data files and applications, note additional end-of-file patterns you can use to help find lost data.
Even though we think of files such as .PCX, .TIF, .JPG and others as standards, their characteristics vary a great deal depending upon the program or device that created them. To help you determine the characteristics of a lost file type that youre not familiar with, create another file on another drive with the same program or device and view it with Disk Editor.
Disk Editor will not run under Windows XP or other NT-based versions of Windows, even in read-only mode. If you are using Disk Editor to recover data from hard or floppy disks, boot your computer with an MS-DOS startup disk (you can create this with the FORMAT option in these versions of Windows). If you want to use Disk Editor to recover data from flash memory or other types of device-driven drives, you will need to use it under Windows 98 or Me in read-only mode (read-only mode requires you to copy recovered data to another drive).
Identifying Unknown Types of Files
As Table 1 indicates, all Microsoft Word, Excel, and PowerPoint files created with recent versions of Microsoft Office have identical starting bytes. Recent versions of Quattro Pro also use the same starting bytes. Although the end of the files will vary according to file type and data contained in the file, you might find yourself creating a recovered file and not know what the correct file extension should be.
One of the tools I depend upon to help determine the correct filetype is the file viewer program QuickView Plus. Previously sold by Jasc Software, its now published by Stellent (http://www.stellent.com). Its a greatly enhanced version of the QuickView program bundled with Windows 95 and 98.
QuickView Plus looks at actual file contents, not at the file extension, so if you copy sectors to a new file in the course of data recovery, QuickView Plus can identify the file type, even if you didnt use the correct extension or forgot to specify an extension when you created the recovered file. After QuickView Plus identifies the file, you can rename the file with the correct extension.
Copyright©2003 Pearson Education. All rights reserved.