- MBR(Master Boot Record) - 使用-m参数
- VBR(Volumn Boot Record) - 使用-v参数 同时需要输入需跳过的扇区数 该项数据可以在-m指令中找到
-a选项可以同时分析MBR与VBR
-
- 将需要分析或者恢复文件的设备通过USB口连接到主机
-
- 除-s/-h参数选项外，使用其他选项运行时还需输入设备名称，设备名称请使用fdisk -l命令来查看。
-
- 参见下方[Usage]
关于FAT32文件系统的更多信息，请移步Wiki。
python fat32_analyzer.py [options] [argument]
-h, -- help get help
-s [sectors] change the number of sectors that you want to read
-m [device] analyze the MBR
-v [device] [sectors] analyze the VBR, MUST input the sectors to skip
-a [device] analyze things above
-r [device] recover file as possible
- on Linux:
- just type in the terminal
python fat32_analyzer.py -r sdb. - then you can recover the files that recently deleted on sdb.
- As for the device name, you can use the
fdisk -lcommand to see.
- just type in the terminal
- This tool can only run on Linux.
- This tool can only undelete the files that are RECENTLY DELETED.You can find the completed content of the undeleted files on Linux,but the undeleted files'names might be a little different.
If you want to know more about FAT32 file system,please go to Wiki.
Created by James
2016.8.15-2016.8.20
