fatcat
FAT filesystem explore, extract, repair, and forensic tool
root@kali:~# fatcat -h
fatcat v1.1.0, Gregwar <g.passault@gmail.com>
Usage: fatcat disk.img [options]
-i: display information about disk
-O [offset]: global offset (may be partition place)
-F [format]: output format (default, json)
Browsing & extracting:
-l [dir]: list files and directories in the given path
-L [cluster]: list files and directories in the given cluster
-r [path]: reads the file given by the path
-R [cluster]: reads the data from given cluster
-s [size]: specify the size of data to read from the cluster
-d: enable listing of deleted files
-x [directory]: extract all files to a directory, deleted files included if -d
will start with rootDirectory, unless -c is provided
* -S: write scamble data in unallocated sectors
* -z: write scamble data in unallocated sectors
FAT Hacking
-@ [cluster]: Get the cluster address and information
-2: analysis & compare the 2 FATs
-b [file]: backup the FATs (see -t)
* -p [file]: restore (patch) the FATs (see -t)
* -w [cluster] -v [value]: write next cluster (see -t)
-t [table]: specify which table to write (0:both, 1:first, 2:second)
* -m: merge the FATs
-o: search for orphan files and directories
* -f: try to fix reachable directories
Entries hacking
-e [path]: sets the entry to hack, combined with:
* -c [cluster]: sets the entry cluster
* -s [size]: sets the entry size
* -a [attributes]: sets the entry attributes
-k [cluster]: try to find an entry that point to that cluster
*: These flags writes on the disk, and may damage it, be careful