FATCAT(1)

💖 FATCAT(1) — bestie's guide to the FAT filesystem 💖

okay so. you found fatcat, and honestly? it's giving main character energy in the command-line world. this is a page from section 1 of the manual, and i'm gonna walk you through it like we're texting at 2am. no cap, every flag stays. let's go 💅

---

✨ NAME ✨

fatcat — FAT filesystem explore, extract, repair, and forensic tool

like… it does ALL of that. explore. extract. repair. forensics. one little kitty. obsessed. 🐱

---

🎀 SYNOPSIS 🎀

fatcat disk.img [options]

that's it. that's the whole vibe. you hand it a disk image, you hand it some options, it does the thing. 🦋

---

🌸 DESCRIPTION 🌸

fatcat is a standalone tool that allow you to explore, extract, repair and forensic FAT filesystems. It currently supports FAT12, FAT16 and FAT32.

standalone!! meaning it doesn't need a whole posse of other tools tagging along. it just shows up and handles FAT12, FAT16 and FAT32 all by itself. queen behavior, fr fr 👑

---

💅 OPTIONS 💅

okay bestie, listen. You should provide an option to fatcat, or you will get the help menu. so like, don't just run it raw and act surprised when it hands you a menu instead of a forensic analysis. 🙈

• -i — Display information about the FAT filesystem
• -l path [-d] — Lists the entries of the directory path. If -d is present, deleted files will be listed.
• -L cluster [-d] — Same as -l, but using the cluster cluster number as source. If -d is present, deleted files will be listed.
• -r path — Reads the file given by path
• -R cluster [-s size ] — Reads the file starting at the cluster cluster number. If size is provied, this will only read size bytes.
• -x target [-c cluster ] [-d] — Extract all the files to the target directory. If you provide a cluster with -c, the extract will start with the given cluster instead that the root directory. If -d is present, deleted files will be extracted.
• -z, -S — -z will write all your unallocated data to zero, and -S will write all your unallocated data to random bytes. this will for instance cause your deleted files to be unreadable.
• -@ cluster — This will display information about the given cluster. It will display its address, which is the offset of the cluster in the image, and the FAT entries (next cluster, unallocated or end of cluster)
• -2 — Compares the two file allocation tables and produce a full diff. This can be used to check that the disk is not corrupted, and have a look to it before trying to merge it with -m.
• -m — Merges the two file allocation tables. This will only keep the allocated entries from on or the other table.
• -b backupfile [-t table ] — Backups your FAT tables to the backupfile file. You can specify with -t the table(s) you want to backup (0:both, 1:first, 2:second). You can then apply the FATs using -p.
• -p backupfile [-t table ] — Patch your FAT table using backupfile previously backuped file (using -b). You can use -t to specify the table(s) you want to patch (0: both, 1:first, 2:second).
• -w cluster -v value [-t table ] — Writes the cluster entry in the FAT to value. You can specify the table using -t (0:both, 1:first, 2: second).
• -o — Search for orphaned files on the disk. This will produce a log listing files, directories and entries that are found. See -L, -R and -x to access those files and directories.
• -f — Walks the directories from the root (/) and try to fix unallocated files and directories FAT table.
• -e path [-c cluster ] [-s size ] — Display information about the entry of the path file or directory. You can edit its cluster or size reference using -c and -s.
• -k cluster — Walks the directories from the root (/) and search an entry referencing the given cluster.

real talk bestie: -z and -S literally overwrite your unallocated data. that's the POINT — it makes your deleted files unreadable. so if you were hoping to recover something later, this is the part where you ✨commit✨. be sure. 💀

also -m only keeps the allocated entries from one table or the other, so maybe vibe check with -2 first? just saying. 🌈

---

🌟 EXAMPLES 🌟

okay this is the fun part. let's actually USE the kitty.

You can explore your disk using -l:

$ fatcat disk.img -l /

And enter directories:

$ fatcat disk.img -l /some/dir/

You can read a file using -R:

$ fatcat disk.img -r /hello.txt
Hello world!
$ fatcat disk.img -r /picture.png > out.png

You can also read files, including deleted ones:

$ fatat disk.img -l / -d

And extract all the files to a target directory:

$ mkdir output/
$ fatcat disk.img -x output/

Let's have a look at the listing:

$ fatcat hello-world.img -l /
Listing path /
Directory cluster: 2
f 25/10/2013 13:30:06  hello.txt                      c=3 s=13 (13B)
d 25/10/2013 13:30:46  files/                         c=4

The cluster of the files directory is 4, this means that we can list it with -L 4:

$ fatcat hello-world.img -L 4
Listing cluster 4
Directory cluster: 4
d 25/10/2013 13:30:22  ./                             c=4
d 25/10/2013 13:30:22  ../                            c=0
f 25/10/2013 13:30:46  other_file.txt                 c=5 s=29 (29B)

The cluster of the other_file.txt file is 5, and its size is 29bytes, we can then read it using -R 5 -s 29:

$ fatcat hello-world.img -R 5 -s 29
Hello!
This is another file!

For more examples and tutorials, have a look at the fatcat tutorial and examples at: <https://github.com/Gregwar/fatcat/blob/master/docs/index.md>

like, go read the tutorial. it's the extended cut. 📖✨

---

👀 SEE ALSO 👀

fatattr(1), mkdosfs(8)

---

🫶 BUGS 🫶

No known bugs.

not a single one. flawless. we love to see it. 💜

---

👑 AUTHOR 👑

Grégoire Passault (g.passault@gmail.com)

---

and that's the whole page bestie!! 🌸🦋 this was fatcat version 1.0.6, dated 28 October 2017, straight out of section 1 of the manual. go forth and explore those FAT filesystems, you absolute icon. periodt. 💖✨🎀