FAT/NTFS File System Directory Entry

Posted on 2009-02-23
Last Modified: 2012-05-06
I am trying to create a file and then access its directory & FAT entries. I also need to erase the file metadata. When you delete a file in FAT file system,  the FAT entries for that file are marked with zeros (to signify unallocation of the data unit(s)) and the first byte of the file name in the directory entry is changed to 0xe5 to signify . Is there a way I could examine the directory & FAT entriies using Hex editor. I have tried to create a file, image it and then view with in an hex editor but what values shall I look at? to determine the directory/FAT entrie for the file?? any suggestions will help. Thanks in advance.
Question by:larusai
    LVL 41

    Accepted Solution

    Here is a pretty good low-level description of the FAT32 disk structures.
    There are quite a few raw-disk editor/viewers, I presonally like: ttp://
    Note, that everything you've described is about the FAT filesystem.... NTFS is completely different (and doesn't mark deleted files the same way as you've described)
    LVL 91

    Assisted Solution

    LVL 91

    Expert Comment


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Why You Should Analyze Threat Actor TTPs

    After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

    Solid State (Hard) Drives aka SSD began to evolve in the computer industry recently. As the name suggests, there are no moving parts in the drives. The drive uses microchip memory store the data, as opposed to the spinning disks of a traditional HDD…
    In this article you will get to know about pros and cons of storage drives HDD, SSD and SSHD.
    This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
    Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    8 Experts available now in Live!

    Get 1:1 Help Now