fatcat(1)

1npage for fatcat
2
3
4man(1)                          fatcat man page                         man(1)
5
6
7

NAME

9       fatcat - FAT filesystem explore, extract, repair, and forensic tool
10

SYNOPSIS

12       fatcat disk.img [options]
13

DESCRIPTION

15       fatcat  is a standalone tool that allow you to explore, extract, repair
16       and forensic FAT filesystems It currently  supports  FAT12,  FAT16  and
17       FAT32.
18

OPTIONS

20       You should provide an option to fatcat, or you will get the help menu
21
22
23       -i
24           Display information about the FAT filesystem
25
26
27       -l path [-d]
28           Lists  the  entries of the directory path If -d is present, deleted
29           files will be listed.
30
31
32       -L cluster [-d]
33           Same as -l, but using the cluster cluster number as source.  If  -d
34           is present, deleted files will be listed.
35
36
37       -r path
38           Reads the file given by path
39
40
41       -R cluster [-s size]
42           Reads  the  file starting at the cluster cluster number. If size is
43           provied, this will only read size bytes.
44
45
46       -x target [-c cluster] [-d]
47           Extract all the files to the target directory.  If  you  provide  a
48           cluster  with -c, the extract will start with the given cluster in‐
49           stead that the root directory.  If -d  is  present,  deleted  files
50           will be extracted.
51
52
53       -z, -S
54           -z  will write all your unallocated data to zero, and -S will write
55           all your unallocated data to random bytes. this will  for  instance
56           cause your deleted files to be unreadable.
57
58
59       -@ cluster
60           This will display information about the given cluster. It will dis‐
61           play its address, which is the offset of the cluster in the  image,
62           and the FAT entries (next cluster, unallocated or end of cluster)
63
64
65       -2
66           Compares  the  two  file allocation tables and produce a full diff.
67           This can be used to check that the disk is not corrupted, and  have
68           a look to it before trying to merge it with -m.
69
70
71       -m
72           Merges  the two file allocation tables. This will only keep the al‐
73           located entries from on or the other table.
74
75
76       -b backupfile [-t table]
77           Backups your FAT tables to the backupfile  file.  You  can  specify
78           with  -t  the  table(s) you want to backup (0:both, 1:first, 2:sec‐
79           ond). You can then apply the FATs using -p.
80
81
82       -p backupfile [-t table]
83           Patch your FAT table using backupfile previously backuped file (us‐
84           ing  -b).  You can use -t to specify the table(s) you want to patch
85           (0: both, 1:first, 2:second).
86
87
88       -w cluster -v value [-t table]
89           Writes the cluster entry in the FAT to value. You can  specify  the
90           table using -t (0:both, 1:first, 2: second).
91
92
93       -o
94           Search  for  orphaned  files  on  the disk. This will produce a log
95           listing files, directories and entries that are found. See  -L,  -R
96           and -x to access those files and directories.
97
98
99       -f
100           Walks  the directories from the root (/) and try to fix unallocated
101           files and directories FAT table.
102
103
104       -e path [-c cluster] [-s size]
105           Display information about the entry of the path file or  directory.
106           You can edit its cluster or size reference using -c and -s.
107
108
109       -k cluster
110           Walks  the directories from the root (/) and search an entry refer‐
111           encing the given cluster.
112
113

EXAMPLES

115       You can explore your disk using -l:
116
117       $ fatcat disk.img -l /
118
119       And enter directories:
120
121       $ fatcat disk.img -l /some/dir/
122
123       You can read a file using -R:
124
125       $ fatcat disk.img -r /hello.txt
126       Hello world!
127       $ fatcat disk.img -r /picture.png > out.png
128
129       You can also read files, including deleted ones:
130
131       $ fatat disk.img -l / -d
132
133       And extract all the files to a target directory:
134
135       $ mkdir output/
136       $ fatcat disk.img -x output/
137
138       Let's have a look at the listing:
139
140       $ fatcat hello-world.img -l /
141       Listing path /
142       Directory cluster: 2
143       f 25/10/2013 13:30:06  hello.txt                      c=3 s=13 (13B)
144       d 25/10/2013 13:30:46  files/                         c=4
145
146       The cluster of the files directory is 4, this means that we can list it
147       with -L 4:
148
149       $ fatcat hello-world.img -L 4
150       Listing cluster 4
151       Directory cluster: 4
152       d 25/10/2013 13:30:22  ./                             c=4
153       d 25/10/2013 13:30:22  ../                            c=0
154       f 25/10/2013 13:30:46  other_file.txt                 c=5 s=29 (29B)
155
156       The  cluster  of the other_file.txt file is 5, and its size is 29bytes,
157       we can then read it using -R 5 -s 29:
158
159       $ fatcat hello-world.img -R 5 -s 29
160       Hello!
161       This is another file!
162
163       For more examples and tutorials, have a look at the fatcat tutorial and
164       examples   at:  <https://github.com/Gregwar/fatcat/blob/master/docs/in‐
165       dex.md>
166
167

BUGS

172       No known bugs.
173

AUTHOR

175       Grégoire Passault (g.passault@gmail.com)
176
177
178
1791.0.6                           28 October 2017                         man(1)