fatcat

fatcat provides comprehensive capabilities for handling FAT filesystems, including getting information, exploring the structure, reading and extracting files or directories, and retrieving deleted items. It enables backing up and restoring FAT tables, hacking entries by modifying clusters and sizes, searching for orphaned files, comparing and merging FAT tables, and repairing unallocated directories and files.

Use cases include digital forensics investigations where FAT filesystem analysis is required, data recovery from damaged or corrupted FAT partitions, and low-level manipulation for repair or testing purposes. The tool is particularly useful for incident response teams dealing with legacy storage media or embedded systems using FAT.

Caution is advised with write operations like patching FATs, writing to clusters, or fixing directories, as they can damage the disk.

fatcat operates by parsing the FAT filesystem structure from a disk image or device, supporting FAT12, FAT16, and FAT32 formats. It reads the boot sector for filesystem parameters, navigates the FAT tables (primary and backup), and traverses directory entries and cluster chains. Features like table comparison analyze discrepancies between FAT1 and FAT2, while hacking modes directly modify table entries or directory attributes. Extraction and reading follow cluster chains, with options for offsets, sizes, and deleted file inclusion. Orphan searches scan unallocated clusters for valid entries.