Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
1
Posts
1
Users
0
Reactions
406
Views
Topic starter
30/10/2009 3:28 am
Hello,
I've been mapping a fat32 formatted USB drive and I'm trying to find the first cluster for a file in the File Allocation Table, so I can identify the cluster run by hand. The layout for the drive is
8 sectors per cluster
80 bytes before dos partition
Reserved - 34 sectors
FAT1 - sector 114
FAT2 - sector 15381
Length of FAT - 15267 sectors
Root dir - sector 30648 = cluster 2
The file I am trying to identify in FAT1 starts at cluster 410762 which is sector 3316648.
Is there a method for finding the sector/offset in the FAT? I'm working from page 265 in File System Forensic Analysis.
Many thanks!