4 ms·
Historical curiosity: during (MS-)DOS times, having two FAT copies at the time could be very helpful. Malware that manipulated FATs was sometimes incorrectly im
by pizza234 4y ago
Historical curiosity: during (MS-)DOS times, having two FAT copies at the time could be very helpful. Malware that manipulated FATs was sometimes incorrectly implemented (for example, assuming that the FAT was either 12 or 16 bits), and in some cases, damage to the FAT could be recovered by restoring the second copy.
- JdeBP 4y agoThey are also used for migrating from FAT12/FAT16 to FAT32. * http://jdebp.info./FGA/bios-parameter-block.html#V7.0 http://jdebp.info./FGA/bios-parameter-block.html#V7.0
- TickleSteve 4y agothe point in TFA is that since the FATs aren't checksummed, determining which of the two is corrupted is a non-trivial task. If you have a corrupt FAT, all you have is two sets of bytes that dont match... which one do you use?
- zinekeller 4y agoIn practice, you (the program) knew which one is corrupted: usually the malware doesn't replace the header with a syntactically-valid FAT, it's unreadable.
- loeg 4y agoThe FAT is just an array of offsets; there’s no syntax structure to validate.
- M95D 4y agoFAT data determines the chain of clusters that form a file. Having the number of clusters in the chain, the file size can be approximated within one cluster size. If that file length approximation matches the directory entry for the file rounded up to the next full cluster, then the FAT data is correct. Also, most FAT corruptions will cross-link together different chains of different files. That's a very good indication that the FAT data is wrong.
- pizza234 4y ago> Also, most FAT corruptions will cross-link together different chains of different files Made me smile :) I remember this particular message, from the time when Flip destroyed my disk.