Recovering deleted data
When a file is deleted in the FAT filesystem, the data itself does not get changed. The first character of the directory entry will have it changed to a xE5 and the file allocation table entries are reset to x00. When the filesystem reads the directory entries, and it encounters the xE5, it will skip that entry and start reading from the subsequent entries.
To recover deleted files, we need to reverse the process the filesystem used to delete the files. Remember, it has not changed the file contents; they still physically reside in their assigned clusters. We now need to reverse-engineer the deletion and recreate the file entry and the entries in the file allocation table. To do this, we need to find the first cluster of the file, the size of the file, and the size of the clusters in the volume:
Figure 5.15: Deleted entry
In the preceding screenshot, we have a directory entry showing that a file has been deleted. We see the xE5 at the start...
