0481 055 328 [email protected]

Camera Cards, USB drives and SD Cards – Data Recovery

by | Nov 21, 2021 | Data Recovery, Deleted Files, Deleted Partitions, FAT filesystem

A very common problem is when people come to me with cards (SD Cards, Compact Flash Cards)  ,see pic below, from cameras where photos are missing. The same problems can occur with USB or flash drives and Micro SD cards from mobile phones.  
Camera Card and Photo Data Recovery
Smartphone SD card Data Recovery
Techniques for Data Recovery with a USB drive
Invariably I start talking about file systems , in this case the FAT file system , and how it has become corrupt but we can recover their photos or docs by doing a raw recovery.  Neither of these 2 things are ever understood so I thought I might talk about why the FAT file system is used and how it becomes corrupt. In my next post I will talk about raw recoveries. For the most part it appears that FAT is used in devices that are not primarily computers eg cameras , smartphones ,  TV’s etc is it’s simplicity. It is easy to implement in code however it’s simplicity is also the main reason why these sorts of recording devices can fail. I am going to describe the FAT file system as simply as possible so that you can understand why they become corrupted.

Fat File System

The file allocation table (FAT) file system was originally designed for small disks and simple folder structures. The file allocation tables and the root folder are  stored in a fixed location on a drive so that the files needed to start the system are easily located.

Structure of a FAT Volume

Data Recovery from a FAT formatted Drive

The Partition Boot Sector

The first sector on a drive is called  Master Boot Record and it uses  the Partition Boot Sector on the system partition to load the operating system kernel files.  On the type of drives we are talking about Micro SD Cards, USB or Flash Drives and Camera Memory Cards there is usually only one partition and the Master Boot Record uses the PBS to find this partition.

File Allocation Table

We can see from the above image two copies of the file allocation table are kept, in case one becomes damaged. The  tables are always  stored in a fixed location so that the files needed to start the system can be correctly located. The file allocation table contains the following types of information about each cluster on the volume

  • Unused (0x0000)
  • Cluster in use by a file
  • Bad cluster (0xFFF7)
  • Last cluster in a file (0xFFF8-0xFFFF)

There is no organization to the FAT folder structure, and files are given the first available location in the area marked other files and folders in the above diagram,

If we look at the diagram below the FAT contains a linked list of where the the information for a file exist on the SD Card or USB drive.

Data Recovery and the File Allocation filesystem

FAT Root Folder

The root folder contains an entry for each file and folder on the root. The only difference between the root folder and other folders is that the root folder is on a specified location on the disk and has a fixed size (512 entries for a hard disk, number of entries on a floppy disk depends on the size of the disk).

Folders have a set of 32-byte Folder Entries for each file and subfolder contained in the folder (see example figure below). The Folder Entry includes the following information:

  • Name (eight-plus-three characters)
  • Attribute byte (8 bits worth of information, described later in this section)
  • Create time (24 bits)
  • Create date (16 bits)
  • Last access date (16 bits)
  • Last modified time (16 bits)
  • Last modified date (16 bits.)
  • Starting cluster number in the file allocation table (16 bits)
  • File size (32 bits)

 

 

Fat File System Common Errors

The file or directory is corrupted and unreadable

The Drive is not formatted.

Directory Structure exists but is unreadable.

It is very common for these sorts of errors