Introduction
 Directory Snoop ™

Version 3.1

Copyright © 1999 Kent Briggs

Briggs Softworks

Introduction

Directory Snoop is a utility program for Windows 95/98 that allows you to snoop around your disk drives at a very low level.  Directory Snoop works on any uncompressed FAT12, FAT16, or FAT32 disk and has the following features:

•	Recover erased files

•	View the raw directory structures and file clusters

•	Search, group, and sort files by name, date, cluster, size, and attributes

•	Search files and raw clusters for content

•	Permanently erase files and individual clusters with 4-pass wiping function

•	Purge erased file names from directory structure

•	View the file allocation table (FAT)

•	Step forwards or backwards through the cluster chains

•	Map files and directories to cluster numbers

•	Verify the effectiveness of file/disk wiping programs

Software License

Directory Snoop is copyrighted software distributed as shareware.  You are granted a temporary 30-day license to try Directory Snoop to see if it will meet your needs.  If you wish to use the program past the 30-day evaluation period, you must purchase the fully-licensed, registered version from the author or an authorized dealer.  Failure to comply with the license agreement is a violation of federal and international copyright laws.  Click the Order Form option on Directory Snoop's Help menu for ordering instructions.

Disclaimer

This software is provided as is and without warranty. The author assumes no liability for damages, either direct or consequential, which may result from the use of this product.

Briggs Softworks Contact Information

Be sure to visit the Briggs Softworks web site and try these other useful Windows programs:

Puffer - Public key encryption with secure file wiping capabilities

CryptaPix - Image file viewer with encryption support

File Maven 95 - Dual directory file manager

Calendar Commander - Design and print calendars

Order Maven – Secure order form generator for online merchants

Author contact:

Kent Briggs <kbriggs@briggsoft.com>

Web site: http://www.briggsoft.com

Association of Shareware Professionals

Kent Briggs is a member of the Association of Shareware Professionals (ASP).  The ASP wants to make sure that the shareware principle works for you.  If you are unable to resolve a shareware related problem with an ASP member by contacting the member directly, the ASP may be able to help.  The ASP Ombudsman can help you resolve a dispute or problem with an ASP member, but does not provide technical support for members' products. Please write to the ASP Ombudsman at 157-F Love Ave., Greenwood, IN 46142 USA, FAX 317-888-2195, or send email to omb@asp-shareware.org.


Interface
Main Window Interface

The interface for Directory Snoop consists of a main window that displays the raw directory structures on your PC plus a cluster window that displays raw cluster data.  The main window contains two tabbed-notebook pages: a Current Directory page that displays all the files and subdirectories (included erased ones) in the current directory and a Global List page that allows you to group selected files and subdirectories from multiple directories and multiple drives.  A toolbar above the pages gives you quick access to most menu commands.  Place the mouse cursor over a toolbar icon to see a hint describing the icon's function.

Current Directory

The Current Directory page contains an Explorer-like directory tree on the left and a listing of all files and subdirectories on the right.  A splitter bar separates the two lists and can be dragged left or right with the mouse to adjust their sizes. Select a directory in the tree structure by clicking on it with the mouse to make it current.  Directories that have subdirectories will have a "+" mark next to them.  Click the "+" mark to expand the directory and the "-" to retract it.  The full path of the current directory will be displayed on the status line at the bottom of the form.  Note that only fixed (hard drives) and removable-media (floppy, Zip, Jaz, etc.) drives are displayed.  Directory Snoop cannot access remote (network) or CD-ROM drives.

The directory list displays all of the files and subdirectories in the current directory.  Unlike Windows Explorer, Directory Snoop displays all available information in the directory.  The list can be displayed in Normal and Raw mode.  In Normal mode, these fields are displayed:

FRec (First Record): the first record number in the directory structure.  The Windows directory structure consists of 32-byte records.  Long file names will span across multiple, consecutive records.

LRec (Last Record): the last record number in the directory for the file.

E: displays "*" if this is an erased file or directory.  The entire line will be displayed in red.

Name: the long file name.

Short: the 8.3 DOS alias file name.  This is the name that 16-bit DOS and Windows 3.1 programs see.

Attr: the file attributes. There are six possible attributes (advshr).

a=archive (usually set by Windows when a file is copied)

d=directory (record is a subdirectory)

v=volume label (only one of these per drive)

s=system (a system file used by Windows)

h=hidden (a hidden file)

r=readonly (readonly file)

Created: the date and time (to 1/100 of a second) the file was created

Accessed: the date the file was last opened (even if it wasn't changed)

Modified: the date and time the file was last modified.

1st Cluster: the first cluster number for the file.  The remaining clusters (if any) are stored in the File Allocation Table (FAT).

Size: the file size in bytes.

When the first directory is displayed, its files appear in the order they are physically stored in the directory structure.  However, you can sort the list by clicking the header over the desired field.  Click the same field header a second time to reverse the sort order. You can adjust the width of individual fields by dragging the borders separating the fields left or right with the mouse.  You can also display the current directory in Raw mode by clicking the Raw tab at the bottom of the list.  This shows the raw 32-byte directory entries in hex and text format.

Global List

The Global list can hold selected files from multiple directories and multiple drives, allowing you to group them together in a convenient order.  The first field in the Global List displays the directory name.  The remaining fields are identical to the ones displayed in the Current Directory list.  Files and directories are added from the current directory to the global list with the Current/Add and the Current/Search functions.

Cluster Viewing

Double click any line in the Current Directory or Global List to view the cluster chain for the selected file or directory.  A cluster chain is the list of clusters that Windows uses to store the contents of the file.  Raw clusters are displayed in Directory Snoop's Cluster Window.


File Menu
File Menu (Main Window)

The File Menu contains commands that work with selected files in either the Current Directory page or the Global List page.  Click on a file record to select it.  To select a range of files, click on the first one and then hold the Shift key down before clicking the last one.  To select or unselect individual files, hold the Ctrl key down while clicking.  The file menu functions are also available on a right-click popup menu in both the Current Directory and the Global List.

Unerase

Use this function to recover an erased file.  When Windows deletes a file (as opposed to just moving it to the recycle bin), the data in the file is not erased.  Instead, the clusters are marked as being unused in the file allocation table (FAT).  Eventually, newly created files will use those clusters so your odds of recovering an erased file decrease as time goes by.

The unerase function works by retrieving the 1st cluster number and the file size from the erased file's directory entry.  It then checks the FAT entry for the starting cluster to see if that cluster is currently being used by another file.  If it is, you are too late to recover the file.  If not, the data in the cluster may still be good.  Directory Snoop then calculates the number of additional clusters needed for a full recovery based on the file size.  If more than 1 cluster is needed, it will check to see if there is a contiguous block of unused clusters following the first one.  If not, a warning will be displayed letting you know that the odds for recovery are not good.

It is important to realize that Directory Snoop never modifies the FAT directly so it does not recover the file in-place.  Instead, it prompts you for a target file name to save the recovered clusters to.  After creating the target file in the directory that you specify, Directory Snoop will read the first cluster from the disk and save a copy of the data to the target file.  It then begins looking for unused clusters (skipping over used ones) until it has collected and saved enough data to match the original file size.

You will need to load the recovered file in the applicable program to see if you were successful or not.  If you plan to unerase multiple files on a disk, it is best if you save the target file on a different drive so that the target file itself does not overwrite clusters that you eventually want to recover.  If that is not practical, you should start with the erased file that has the lowest starting cluster number as Windows will usually pick the first unused cluster it finds to create the target file.  It will also use the first available directory entry that it finds in the directory you select to store the target file so keep that in mind also if you are unerasing multiple files from a single directory.

You can also recover erased files manually by using the target file functions available in the Cluster Window.  The manual method is also needed to recover files from an erased directory as Directory Snoop cannot do that directly.

Search

Use this function to search for a string inside the selected files.  A dialog box will prompt you for the string to search for.  The following options are available:

Case sensitive:  Check this option to perform a case sensitive search.  For example, if a file contains the string "Snoop", and you enter a search string of "snoop", the search will fail if this option is checked because the uppercase "S" does not match the lowercase "s".

Hex bytes: Check this option to search for binary data instead of a text string.  Enter an even number of hexadecimal digits (0123456789ABCDEF) to form a whole number of bytes.  You may insert spaces between bytes for readability.

Find only first match in each file: Check this option if you want the search to jump to the next selected file after a match is found.  Otherwise, the entire file is searched and every match will be reported.

Purge

This option will "blank out" an erased record so that no one will know it ever existed.  When you erase a file in Windows, the operating system simply marks its directory entry with a special character (overwriting the first character in the Short name) and then frees up its data clusters in the file allocation table (FAT).  Eventually, the directory record may get overwritten when new files are added to the directory but you can use the Purge function to remove them now.

Only erased records can be purged.  Erased records are displayed in red and have an "*" in the "E" column.  Since clicking the header above each column causes the list to be sorted by that column, you can conveniently group all of the erased files together by clicking the header above the "E" column.  Click a second time to reverse the sort.

Note that directory entries may span across multiple records (due to long file names) in the directory structure so you may see an increase in the number of items in the Current Directory list after a purge.  This is because each 32-byte record in the purged entry will then be displayed on a separate line.

Wipe

The wipe function is used to permanently erase the selected files so that their data can never be recovered.  Use this feature with caution!  It works by overwriting the data inside the file and then performing a normal erase.  A confirmation dialog will appear asking you to select one of two wipe options:

1-pass: this will overwrite the file with one pass of binary zeros.

4-pass: this will overwrite the file with four passes.  Pass 1 is hex byte AA (10101010 binary).  Pass 2 is hex byte 55 (01010101).  Pass three is a pseudo-random byte string, unique for each file.  Pass 4 is binary zeros.

The 1-pass option is sufficient for most people and will stop all software-based systems from recovering the file.  The 4-pass option is only needed to help thwart forensic hardware systems that can recover data from magnetic residue laid down during previous writes.

The Wipe function only destroys the file's data but does not remove the directory entry so you may want to follow up with the Purge function if you want to remove all evidence of a file's existence.

You can test the effectiveness of Directory Snoop's wipe function (or any program's wipe function) by first double-clicking the file to see its cluster chain.  Make a note of the cluster numbers and then wipe the file.  Then go back and view those same clusters (see View cluster chain on the Current menu) and confirm they have been wiped.

Print List

Use this function to print the file list.  It works in both the Current Directory and the Global List.  A dialog box will appear allowing you to select or unselect specific columns to print.  The printed text will be automatically scaled to the page width so that all selected columns are sized in roughly the same proportion as they appear on the screen.  Use the Landscape orientation or uncheck one or more columns to increase the font size (12 point maximum).

Select All

This function selects all files in the list.

Exit

Exit the Directory Snoop program.


Current Menu
Current Menu (Main Window)

The Current Menu contains commands that are only available when the Current Directory page is selected.

Add files to global list

Use this function to add all the selected files in the Current Directory page to the Global list.  This function is also available on the right-click popup menu.

Search & add files to global list

Use this function to search the current directory (and possibly its subdirectories) for certain files that meet your criteria and then add them to the global list.  A dialog box will appear allowing you to limit your search to files with very specific attributes:

Filename spec: use this option to match a specific filename.  You may use the "*" (match multiple characters) and "?" (match a single character) wildcards.  The default value is "*.*" which matches all files.

Ignore case: checking this option means that the Filename spec is not case sensitive.  The default value is checked.

Shortname spec: use this option to match a specific short (DOS alias) name.  The "*" and "?" wildcards are also supported here.  The default value is "*.*" which matches all files.

File type: use this option to filter out normal or erased records.  The default option is Both which matches all records.

Creation date: use this option to filter out files by the date they were created.  The default values are all 0's for the Earliest date and all 9's for the Latest date which matches all files.

Accessed date: use this option to filter out files by the date they were last accessed.  The default values are all 0's for the Earliest date and all 9's for the Latest date which matches all files.

Modified date: use this option to filter out files by the date they were last modified.  The default values are all 0's for the Earliest date and all 9's for the Latest date which matches all files.

Starting cluster: use this option to filter out files by their starting cluster number.  The default values are 0 for Smallest and 2147483647 (the largest possible 32-bit signed integer) for Largest which matches all files.

Size: use this option to filter out files by their size in bytes.  The default values are 0 for Smallest and 2147483647 (the largest possible 32-bit signed integer) for Largest which matches all files.

Attributes: use this option to filter out files by any of the six possible attributes (archive, directory, volume, system, hidden, readonly).  The default value for each is Either, which matches all files.

Include '.' & '..' records: check this option to include the "." and ".." records that represent the current and parent directory.  Every directory except for the root directory contain these records at the beginning.  The default value is checked on.

Include files from subdirectories: check this option if you want the search to continue through all lower level subdirectories.  If the current directory is the root directory, the entire drive will be search if this option is checked.  Otherwise, only files and directories in the current directory can be added to the global list.

Clear global list first: check this option to empty the global list before adding new files from the search.  Otherwise, files that match the search criteria will be added to the end of the files already in the global list.

Warning: the global list does not check for duplicate files so be aware of that when adding files in multiple searches.

Refresh current directory

Select this command to force Directory Snoop to reload the current directory from the disk.

View disk specs

Select this command to view technical specifications for the current disk including the following:

Device type

00h = 320/360K floppy

01h = 1.2Mb floppy

02h = 720K floppy

03h = 8-inch, single density

04h = 8-inch, double density

05h = hard disk

06h = tape drive

07h = 1.44Mb floppy

08h = read/write optical

09h = 2.88Mb floppy

Device attributes

Bit 0=0: medium is removable

Bit 0=1: medium is not removable

Bit 1=0: disk change-line not supported

Bit 1=1: disk change-line supported

Cylinders

Maximum number of cylinders that the physical device can support.

Media type (1.2Mb drives)

Bit 0=0: accepts quad-density, 1.2Mb disks

Bit 0=1: accepts double-density, 320/360K disks

Serial number

The serial number for the medium (in hex).  This value is usually assigned when the disk is formatted.

Volume label

The volume label for the medium (11 characters max).  This string is usually input by the user when the disk is formatted.

File system type

FAT12 = 12-bit file allocation table (for drives with 4086 or fewer clusters)

FAT16 = 16-bit file allocation table (for drives with 4087 to 65526 clusters)

FAT32 = 32-bit file allocation table (for drives with more than 65526 clusters)

Bytes per sector

Number of bytes per sector (usually 512).  A sector is the drive's smallest storage unit.

Sectors per cluster

Number of sectors in a cluster (always a power of 2).  A cluster is the smallest storage unit allocated to files and directories.

Reserved sectors

Number of reserved sectors on the drive (starting with sector 0).  This value is typically 1 for FAT12/16 drives and 32 for FAT32 drives.  The drive's boot sector is located in this area.

Number of FATs

Number of file allocation tables (usually 2).  The FAT(s) are located immediately after the reserved sectors.  The FAT holds the cluster table which is a global index specifying the location of all files and directories on the drive.  Additional FATs are used as a backup in case of disk corruption.

Root entries

Maximum number of root directory entries.  The root directory is located immediately after the FATs on FAT12 and FAT16 drives.  Each entry occupies 32 bytes.  This value is 0 for FAT32 drives.

Total sectors

Number of sectors on the drive.  If the drive is greater than 32Mb, then this value is 0 and the actual number of sectors is stored in the Big total sectors field.

Media descriptor

F0h = 3.5" (1.44Mb or 2.88Mb) or 5.25" (1.2Mb) floppy

F8h = hard disk

F9h = 3.5" (720K) or 5.25" (1.2Mb) floppy

FAh = 5.25" (320K) floppy, 1 side

FBh = 3.5" (640K) floppy

FCh = 5.25" (180K) floppy

FDh = 5.25" or 8" (360K) floppy

FEh = 5.25" or 8" (160K) floppy

FFh = 5.25" (320K floppy), 2 sides

Sectors per FAT

Number of sectors occupied by each FAT.  This value is 0 on a FAT32 drive.

Sectors per track

Number of sectors on a single track.

Heads

Number of read/write heads on the drive.

Hidden sectors

Number of hidden sectors on the drive.  These usually contain drive partition information.

Big total sectors

Total number of sectors on drives larger than 32Mb.  This number is stored in the Total sectors field for smaller drives.

Big sectors per FAT

Number of sectors per FAT (FAT32 drives only).

Ext flags

Flags for FAT32 drives.  Low 4 bits (0-3) contain the FAT number of the Active FAT.  Bit 8 is 0 when FAT mirroring is enabled.

FS Version

File system version for FAT32 drive.  High byte contains major version, low byte contains minor version.

Root dir start cluster

First cluster of root directory on a FAT32 drive.  Note: the root directory on FAT12 and FAT16 drives is fixed immediately after the FATs.

FS info sector

Sector number for the BIGFATBOOTFSINFO structure (FAT32 only).  This number is 65535 if there is no FS info sector.

Backup boot sector

Sector number of the backup boot sector (FAT32 only).  This number is 65535 if there is no backup boot sector.

View cluster chain

Select this command to view a cluster chain and/or the file allocation table (FAT).


Global Menu
Global Menu (Main Window)

The Global Menu contains commands that are only available when the Global List page is displayed.

Remove

This command removes the selected files from the Global List.  Note that this command does not erase files or alter them in any way.  It simply removes them from the list. This function is also available on the right-click popup menu.

Clear list

This command empties the Global List.  Note that this command does not erase files or alter them in any way.  It simply removes them from the list.


Help Menu
Help Menu (Main Window)

The Help Menu contains the following three commands:

Contents

Displays the Contents dialog for the online help system.

Order form

Displays instructions for ordering a license for Directory Snoop.  The shareware version is free to try for 30 days.  If you wish to use Directory Snoop beyond the trial period, you must purchase a license from Briggs Softworks or an authorized dealer.

About

Displays an "About" dialog, showing the program title, version number, and copyright notice.


Interface
Cluster Window Interface

There are two ways to view raw clusters with Directory Snoop.  From the main program window, you can double click on a file in either the current directory listing or the global list.  This will take you to the cluster view window and will display the file's cluster chain.  You can also select "View cluster chain" from the Current menu.

The interface for the cluster window consists of a tabbed notebook entry on the left and a listbox on the right that displays the current cluster.  The notebook control is divided into two pages: Chain and FAT.

Chain Page

The Chain page lists the cluster numbers for the current file chain.  Click on any cluster number in the chain list to view the data in that cluster.

FAT Page

The FAT page lists the File Allocation Table for the current drive.  You must manually load the FAT from the menu or toolbar.  Once loaded, you can click on any cluster number in the table to view the data in that cluster.

File Allocation Table

The FAT is an index on every formatted disk that contains a map of the cluster chain for each file and subdirectory on the disk.  The starting cluster is located in the file's directory entry.  Each entry in the FAT points to the file's next cluster.  A specially coded number marks the file's last cluster.  Directory Snoop displays this end-of-file entry as <eof>.  Available clusters are marked as <unused>, defective clusters are marked as <bad> and reserved clusters are marked as <res>.

The clusters for any given file are not necessarily in sequential order.  As you create and delete files, gaps in the FAT begin to appear and new files might get spread across the disk in non-sequential clusters.  When you use the Disk Defragmenter program included with Windows 95/98, it rearranges the clusters on the disk so that all the files are moved to the front of the disk and their clusters are ordered sequentially.

Directory Snoop calculates a "Reverse FAT" so that when a cluster is selected in the FAT list, the previous cluster number in the chain is also displayed below the list.  In fact, Directory Snoop will also tell you how many clusters are in the current chain, which one in the sequence you are currently looking at, as well as the first and last cluster numbers in the chain.  You may click on any of these cluster numbers to jump directly to them in the FAT list.  For example, if you continuously click the cluster number to the right of the "Next" label, you will step through a file's cluster chain in order until the <eof> marker is reached.  You may also type in a cluster number in the edit box label "Current" and then press Enter to jump directly to it.  To search the FAT for the next unused, end-of-file, bad, or reserved cluster, type in the corresponding first letter (u,e,b,r) and press Enter.


File Menu
File Menu (Cluster Window)

The file menu contains commands for using the Target file function.  A target file is a file that you specify (either new or existing) that will have data from raw clusters appended to it.  It is especially handy for recovering erased file data.

Open target file

Use this command to select a target file.  A standard open file dialog will be displayed.  You may select an existing file or create a new file by entering a unique file name.  If you select an existing file, a warning will be displayed letting you know that any data saved with the Append command will be tacked on to the end of the existing data.  The name of the current target file is displayed on the bottom status line along with its current file size.

Append data to target file

Use this command to append raw cluster data to the current target file.  If the Chain page is active when this command is selected, you are restricted to saving only clusters that appear in the current file chain.  If the FAT page is active, you have access to all data clusters on the current drive.  A cluster selection dialog will be displayed with the following controls:

First cluster: the first cluster to append to the target file.  If the Chain page is active, this option is frozen with the cluster selected in the chain list.

Whole clusters: the number of whole clusters to append to the target file, starting with the first cluster specified above.

Bytes per cluster: the number of bytes in a cluster.  This value is calculated automatically by Directory Snoop and is not adjustable.

Additional bytes: the number of bytes from the beginning of one additional cluster to append to the target file.  This number can range from 0 to 1 byte less than the bytes per cluster value.

Total bytes: the total number of bytes to append to the target file.  If you adjust this number manually, the Whole Clusters and Additional Bytes values will be adjusted accordingly (and vice versa).

Advance cluster to: the method of cluster advancement when data from more than 1 cluster is to be appended to the target file:

Next in chain: the cluster number will be advanced to the next cluster in the file chain.  This is the only option available when the Chain page is active.

Next in FAT: the cluster number will be incremented by 1.

Next unused: the cluster number will be advanced to the next unused cluster found in the FAT.  This option is handy for manually recovering erased files.

Note that the number of actual bytes appended to the target file might not equal the Total Bytes value selected if the clusters cannot be advance any further due to end of chain, end of FAT, or no more unused clusters (depending on the Advance Cluster To option).

Close target file

This command closes the current target file.

Exit

This command closes the Cluster Window and returns control to the Main Window.


Cluster Menu
Cluster Menu (Cluster Window)

The Cluster Menu contains commands for searching, wiping, and displaying raw data clusters.

Search clusters

Use this function to search for a string inside raw clusters.  If the Chain page is active when this command is selected, you are restricted to searching only clusters that appear in the current file chain.  If the FAT page is active, you have access to all data clusters on the current drive.  A dialog box will prompt you for the string to search for.  The following options are available:

First cluster: the first cluster to be searched.  If the Chain page is active, this option is frozen with the cluster selected in the chain list.

Number of clusters: the number of clusters to search through, starting with the first cluster specified above.

Advance cluster to: the method of cluster advancement when data from more than 1 cluster is to be searched:

Next in chain: the cluster number will be advanced to the next cluster in the file chain.  This is the only option available when the Chain page is active.

Next in FAT: the cluster number will be incremented by 1.

Next unused: the cluster number will be advanced to the next unused cluster found in the FAT.  This option is handy for searching erased file data.

Note that the number of actual clusters searched might not equal the number selected if the clusters cannot be advance any further due to end of chain, end of FAT, or no more unused clusters (depending on the Advance Cluster To option).

Case sensitive:  Check this option to perform a case sensitive search.  For example, if a cluster contains the string "Snoop", and you enter a search string of "snoop", the search will fail if this option is checked because the uppercase "S" does not match the lowercase "s".

Hex bytes: Check this option to search for binary data instead of a text string.  Enter an even number of hexadecimal digits (0123456789ABCDEF) to form a whole number of bytes.  You may insert spaces between bytes for readability.

Find only first match in each cluster: Check this option if you want the search to advance to the next cluster after a match is found.  Otherwise, the entire cluster is searched and every match will be reported.

Allow string to cross cluster boundaries: Check this option if you want the search to find strings that start near the end of a cluster and continue into the next one to be searched.

Wipe unused cluster

Use this command to overwrite the current cluster with binary zeros so that its current contents is destroyed.  This command only works with unused clusters and has two wiping options:

1-pass: this will overwrite the cluster with one pass of binary zeros.

4-pass: this will overwrite the cluster with four passes.  Pass 1 is hex byte AA (10101010 binary).  Pass 2 is hex byte 55 (01010101).  Pass three is a pseudo-random byte string, unique for each cluster.  Pass 4 is binary zeros.

The 1-pass option is sufficient for most people and will stop all software-based systems from recovering the data.  The 4-pass option is only needed to help thwart forensic hardware systems that can recover data from magnetic residue laid down during previous writes.

Format

The cluster data can be displayed in any of these three formats:

Hex format: data is displayed in hexadecimal format with 16 bytes per line.  The cluster offset (hex) is displayed first, followed by the 16 data bytes, followed by the ASCII characters for those 16 bytes.  This is the default format when a file is double clicked in the Main Window.

Text format: data is displayed in text format with each line terminated by a linefeed or carriage return/linefeed sequence.

Directory format: data is displayed in a directory format.  This is the default format when a directory is double clicked in the Main Window.


FAT Menu
FAT Menu (Cluster Window)

The FAT Menu contains two commands relating to the File Allocation Table.  You must select the FAT page before accessing this menu.

Load/Reload

This command loads the FAT from the current drive.  Most disks have two FAT tables with the second one used for emergency backup.  Directory Snoop only accesses the first FAT table.  The FAT is read by Directory Snoop but never modified directly.  A "Reverse FAT" is also calculated in memory so that you can step both forwards and backwards through a cluster chain.  Note that the FAT table is modified frequently by the operating system as files are created, modified, and deleted so you may need to Reload the FAT often to ensure you are working with correct data.  It is advisable that you shut down all other running applications before starting Directory Snoop to minimize disk activity.

Map clusters to file names

Use this function to map file names to the clusters in the FAT.  The FAT only knows which clusters belong together but it does not know which files and directories are using them.  The starting cluster for every file and directory is stored in the directory records along with the file names, dates, and sizes.  The Map function will search through every file and directory on the current drive, retrieve its starting cluster number, and then build a map to all clusters in the FAT.  The result is that when you click on any cluster in the FAT, the file or directory that owns it will be displayed on the status bar above the cluster data.  Note that the data in the map might be incorrect if files are created, modified, or deleted since the last map was made so it may need to be refreshed often.


Help Menu
Help Menu (Cluster Window)

Cluster window

This command displays the Cluster Window section of the online help system.


Misc
Misc. Technical Information

File Allocation Table

Windows 95/98 uses a File Allocation Table (FAT) type file system.  This same system has been used since the early versions of DOS. The FAT is a lookup table that has an entry for each cluster on the disk.  Each entry points to the next cluster in the chain for the file using it.  Special cluster numbers indicate if a cluster is unused, is the last cluster in the chain, or contains bad sectors.

Until recently, all FATs used 12-bit or 16-bit cluster tables.  Drives formatted with 4086 or fewer clusters (mostly floppy disks) use the 12-bit FAT.  Larger drives use 16-bit FATs.  The 32-bit FAT drives recently introduced by the OSR2 version of Windows 95 now allow drives to have more than 65535 clusters.

Directory Entries

Windows stores the names of files and associated attributes in a 32-byte directory entry.  This directory system has been used since the early days of DOS.  This DIRENTRY structure is mapped as follows:

Offset	Field	Notes

0	DOS Name	8 chars max, padded with spaces

8	DOS Extension	3 chars max, padded with spaces

11	Attributes	r,h,s,v,d,a (see below)

12	Reserved	not used

13	CentiSeconds	.01 second intervals added to creation time

14	Create Time	time file was created

16	Create Date	date file was created

18	Access Date	date file was last accessed

20	Cluster-High	starting cluster high word (FAT32 only)

22	Mod Time	time file was last modified

24	Mod Date	date file was last modified

26	Cluster-Low	starting cluster low word

28	Size	file size (4 bytes)

The 16-bit time and date fields are coded as follows:

bits	field

0..4	second divided by 2 (0..29)

5..10	minute (0..59)

11-15	hour (0..23)

0..4	day (1..31)

5..8	month (1..12)

9..15	year minus 1980 (0..127)

The 8-bit attributes field is coded as follows:

bit	attribute (0=off, 1=on)

0	read-only

1	hidden

2	system

3	volume

4	directory

5	archive

6..7	(unused)

With the release of Windows 95, Microsoft wanted to implement support for long file names but still remain compatible with 16-bit software.  Basically, how it works is that each file still has a short name entry but in addition may have multiple long name entries stored immediately in front of the short name entry.  To keep 16-bit software from becoming confused with these new long name entries, the attribute byte in them is always set to 0f hex, which makes it look like a read-only, hidden, system, volume label.  16-bit software will just skip over these entries since they are usually not concerned with volume labels when looking for files.  Most of the remaining bytes in the directory entry were then available to store the long names.

Long file names are stored in 16-bit Unicode format instead of the usual 8-bit ascii format.  This leaves only enough room to store 13 characters in each 32-byte entry.  Longer names simply span across multiple directory entries, in reverse order.  The first byte in a long file name entry is a sequence byte.  The next 10 bytes contain five characters of the name.  The next byte is the attribute byte (always 0f).  Then comes a 1 byte type indicator (always 0) followed by a 1 byte checksum.  The next 12 bytes contain the next 6 characters.  Following this is 2 bytes for the cluster number field (always 0) and the final 4 bytes contain 2 more characters in the name.