Finding a cluster i...
 
Notifications
Clear all

Finding a cluster in FAT

1 Posts
1 Users
0 Reactions
406 Views
(@clusterone)
Eminent Member
Joined: 16 years ago
Posts: 39
Topic starter  

Hello,

I've been mapping a fat32 formatted USB drive and I'm trying to find the first cluster for a file in the File Allocation Table, so I can identify the cluster run by hand. The layout for the drive is

8 sectors per cluster
80 bytes before dos partition
Reserved - 34 sectors
FAT1 - sector 114
FAT2 - sector 15381
Length of FAT - 15267 sectors
Root dir - sector 30648 = cluster 2

The file I am trying to identify in FAT1 starts at cluster 410762 which is sector 3316648.

Is there a method for finding the sector/offset in the FAT? I'm working from page 265 in File System Forensic Analysis.

Many thanks!


   
Quote
Share: