Comments on: Recovering Folder Relationships Using DOS Clustering Design http://www.dtidata.com/resourcecenter/2008/11/18/recovering-folder-relationships-using-dos-clustering-design/ Hard drive recovery data recovery resource center with how to guides for windows RAID Snap server file system repair NTFS partition recovery tools tips and tricks to recover data Mon, 22 Feb 2010 16:34:14 -0500 http://wordpress.org/?v=2.9.2 hourly 1 By: Joseph Whitehead http://www.dtidata.com/resourcecenter/2008/11/18/recovering-folder-relationships-using-dos-clustering-design/#comment-6634 Joseph Whitehead Thu, 22 Jan 2009 09:13:52 +0000 http://www.dtidata.com/resourcecenter/?p=740#comment-6634 Oops didn't see that this was a multipart article. I imagine that you covered most of that. Oops didn’t see that this was a multipart article. I imagine that you covered most of that.

]]> By: Joseph Whitehead http://www.dtidata.com/resourcecenter/2008/11/18/recovering-folder-relationships-using-dos-clustering-design/#comment-6633 Joseph Whitehead Thu, 22 Jan 2009 09:12:22 +0000 http://www.dtidata.com/resourcecenter/?p=740#comment-6633 Find the root directory using "COMMAND" every 32 bytes. hehe, easy. Another way is to look for a "Volume" entry along with valid-looking file and folder entries. Find partitions using many ways: One is to find the root directory, then work your way back. This at least gives you a count of the number of probable partitions, and gives a good estimate of starting/ending sectors. 2nd way: Finding the "FF...F8" or such signatures followed by bytes that mostly grow in sequence/are zero indicates the first and second FAT's starting positions. Do a little subtraction to find out the number of clusters, among other things. Wow, this is all so 1989. FAT32 came in the 90s, and then there came NTFS. NTFS is an entirely different ballgame. You have to know all kinds of tricks that make automated tools a life saver. Find the root directory using “COMMAND” every 32 bytes. hehe, easy. Another way is to look for a “Volume” entry along with valid-looking file and folder entries.

Find partitions using many ways: One is to find the root directory, then work your way back. This at least gives you a count of the number of probable partitions, and gives a good estimate of starting/ending sectors.

2nd way: Finding the “FF…F8″ or such signatures followed by bytes that mostly grow in sequence/are zero indicates the first and second FAT’s starting positions. Do a little subtraction to find out the number of clusters, among other things.

Wow, this is all so 1989. FAT32 came in the 90s, and then there came NTFS. NTFS is an entirely different ballgame. You have to know all kinds of tricks that make automated tools a life saver.

]]>