4 ms·
the point in TFA is that since the FATs aren't checksummed, determining which of the two is corrupted is a non-trivial task. If you have a corrupt FAT, all you
by TickleSteve 4y ago
the point in TFA is that since the FATs aren't checksummed, determining which of the two is corrupted is a non-trivial task.
If you have a corrupt FAT, all you have is two sets of bytes that dont match... which one do you use?
- zinekeller 4y agoIn practice, you (the program) knew which one is corrupted: usually the malware doesn't replace the header with a syntactically-valid FAT, it's unreadable.
- loeg 4y agoThe FAT is just an array of offsets; there’s no syntax structure to validate.
- M95D 4y agoFAT data determines the chain of clusters that form a file. Having the number of clusters in the chain, the file size can be approximated within one cluster size. If that file length approximation matches the directory entry for the file rounded up to the next full cluster, then the FAT data is correct. Also, most FAT corruptions will cross-link together different chains of different files. That's a very good indication that the FAT data is wrong.
- pizza234 4y ago> Also, most FAT corruptions will cross-link together different chains of different files Made me smile :) I remember this particular message, from the time when Flip destroyed my disk.