FAT/NTFS File System Directory Entry

Posted on 2009-02-23
Medium Priority
Last Modified: 2012-05-06
I am trying to create a file and then access its directory & FAT entries. I also need to erase the file metadata. When you delete a file in FAT file system,  the FAT entries for that file are marked with zeros (to signify unallocation of the data unit(s)) and the first byte of the file name in the directory entry is changed to 0xe5 to signify . Is there a way I could examine the directory & FAT entriies using Hex editor. I have tried to create a file, image it and then view with in an hex editor but what values shall I look at? to determine the directory/FAT entrie for the file?? any suggestions will help. Thanks in advance.
Question by:larusai
  • 2
LVL 41

Accepted Solution

graye earned 1000 total points
ID: 23718159
Here is a pretty good low-level description of the FAT32 disk structures.  http://www.scribd.com/doc/2187273/FAT32-File-System-Specification
There are quite a few raw-disk editor/viewers, I presonally like: ttp://mh-nexus.de/en/hxd/
Note, that everything you've described is about the FAT filesystem.... NTFS is completely different (and doesn't mark deleted files the same way as you've described)
LVL 93

Assisted Solution

nobus earned 1000 total points
ID: 23719452
LVL 93

Expert Comment

ID: 23719453

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you tried to learn about Unicode, UTF-8, and multibyte text encoding and all the articles are just too "academic" or too technical? This article aims to make the whole topic easy for just about anyone to understand.
When we purchase storage, we typically are advertised storage of 500GB, 1TB, 2TB and so on. However, when you actually install it into your computer, your 500GB HDD will actually show up as 465GB. Why? It has to do with the way people and computers…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question