1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209
|
npage for fatcat
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Contact g.passault@gmail.com to correct errors or typos.
.TH man 1 "07 August 2014" "1.0.5" "fatcat man page"
.SH NAME
fatcat \- FAT filesystem explore, extract, repair, and forensic tool
.SH SYNOPSIS
fatcat disk.img [options]
.SH DESCRIPTION
fatcat is a standalone tool that allow you to explore, extract, repair and forensic FAT filesystems
It currently supports FAT12, FAT16 and FAT32.
.SH OPTIONS
You should provide an option to fatcat, or you will get the help menu
.PP
\fB\-i\fP
.RS 4
Display information about the FAT filesystem
.RE
.PP
\fB\-l path [\-d]\fP
.RS 4
Lists the entries of the directory \fBpath\fP
If \fB\-d\fP is present, deleted files will be listed.
.RE
.PP
\fB\-L cluster [\-d]\fP
.RS 4
Same as \fB\-l\fP, but using the \fBcluster\fP cluster number as source.
If \fB\-d\fP is present, deleted files will be listed.
.RE
.PP
\fB\-r path\fP
.RS 4
Reads the file given by \fbpath\fP
.RE
.PP
\fB\-R cluster [\-s size]\fP
.RS 4
Reads the file starting at the \fBcluster\fP cluster number. If \fBsize\fP is provied,
this will only read \fBsize\fP bytes.
.RE
.PP
\fB\-x target [\-c cluster] [\-d]\fP
.RS 4
Extract all the files to the \fBtarget\fP directory. If you provide a cluster with
\fB\-c\fP, the extract will start with the given cluster instead that the root directory.
If \fB\-d\fP is present, deleted files will be extracted.
.RE
.PP
\fB\-z, \-S\fP
.RS 4
\fB\-z\fP will write all your unallocated data to zero, and \fB\-S\fP will write all your
unallocated data to random bytes. this will for instance cause your deleted files to
be unreadable.
.RE
.PP
\fB\-@ cluster\fP
.RS 4
This will display information about the given \fBcluster\fP. It will display its address, which
is the offset of the cluster in the image, and the FAT entries (next cluster, unallocated
or end of cluster)
.RE
.PP
\fB\-2\fP
.RS 4
Compares the two file allocation tables and produce a full diff. This can be used to check that
the disk is not corrupted, and have a look to it before trying to merge it with \fB\-m\fP.
.RE
.PP
\fB\-m\fP
.RS 4
Merges the two file allocation tables. This will only keep the allocated entries from on or the
other table.
.RE
.PP
\fB\-b backupfile [\-t table]\fP
.RS 4
Backups your FAT tables to the \fBbackupfile\fP file. You can specify with \fB\-t\fP the
table(s) you want to backup (0:both, 1:first, 2:second). You can then apply the FATs
using \fB\-p\fP.
.RE
.PP
\fB\-p backupfile [\-t table]\fP
.RS 4
Patch your FAT table using \fBbackupfile\fP previously backuped file (using \fB\-b\fP).
You can use \fB\-t\fP to specify the table(s) you want to patch (0: both, 1:first, 2:second).
.RE
.PP
\fB\-w cluster \-v value [\-t table]\fP
.RS 4
Writes the \fBcluster\fP entry in the FAT to \fBvalue\fP. You can specify the table using
\fB-t\fP (0:both, 1:first, 2: second).
.RE
.PP
\fB\-o\fP
.RS 4
Search for orphaned files on the disk. This will produce a log listing files, directories
and entries that are found. See \fB\-L\fP, \fB\-R\fP and \fB\-x\fP to access those files and
directories.
.RE
.PP
\fB\-f\fP
.RS 4
Walks the directories from the root (/) and try to fix unallocated files and directories
FAT table.
.RE
.PP
\fB\-e path [\-c cluster] [\-s size]\fP
.RS 4
Display information about the entry of the \fBpath\fP file or directory. You can edit its
cluster or size reference using \fB\-c\fP and \fB\-s\fP.
.RE
.PP
\fB\-k cluster\fP
.RS 4
Walks the directories from the root (/) and search an entry referencing the given \fBcluster\fP.
.RE
.SH EXAMPLES
You can explore your disk using \fB\-l\fP:
$ fatcat disk.img \-l /
And enter directories:
$ fatcat disk.img \-l /some/dir/
You can read a file using \fB\-R\fP:
$ fatcat disk.img \-r /hello.txt
Hello world!
$ fatcat disk.img \-r /picture.png > out.png
You can also read files, including deleted ones:
$ fatat disk.img \-l / \-d
And extract all the files to a target directory:
$ mkdir output/
$ fatcat disk.img \-x output/
Let's have a look at the listing:
.Vb 5
\& $ fatcat hello-world.img \-l /
\& Listing path /
\& Directory cluster: 2
\& f 25/10/2013 13:30:06 hello.txt c=3 s=13 (13B)
\& d 25/10/2013 13:30:46 files/ c=4
.Ve
The cluster of the \fBfiles\fP directory is \fB4\fP, this means that we
can list it with \fB\-L 4\fP:
.Vb 5
\& $ fatcat hello-world.img \-L 4
\& Listing cluster 4
\& Directory cluster: 4
\& d 25/10/2013 13:30:22 ./ c=4
\& d 25/10/2013 13:30:22 ../ c=0
\& f 25/10/2013 13:30:46 other_file.txt c=5 s=29 (29B)
.Ve
The cluster of the \fBother_file.txt\fP file is 5, and its size is 29bytes,
we can then read it using \fB\-R 5 \-s 29\fP:
.Vb 5
\& $ fatcat hello-world.img \-R 5 \-s 29
\& Hello!
\& This is another file!
.Ve
For more examples and tutorials, have a look at the \fBfatcat\fP tutorial and examples
at: <\fBhttps://github.com/Gregwar/fatcat/blob/master/docs/index.md\fR>
.SH SEE ALSO
fatattr(1), mkdosfs(8)
.SH BUGS
No known bugs.
.SH AUTHOR
Grégoire Passault (g.passault@gmail.com)
|