How to Recover Deleted Files from a FAT32 USB Drive Using Hex Analysis : A Deep Dive into File System Forensics

FAT32 #FAT_File_Structure #OperatingSystems #WindowsOS

In this blog post, we’ll find how the FAT32 file system works and demonstrate how operating systems manage and store data at the lowest level. Specifically, you’ll learn how to retrieve deleted files from a USB drive image by analyzing the file system’s raw hexadecimal data.

We’ll walk through the process of reading and interpreting hex values, understanding how deleted file entries are structured, and manually locating file data based on FAT (File Allocation Table) metadata ; a format commonly used in USB drives.

To follow along smoothly, it helps if you have some basic knowledge of:

🐧 Linux terminal commands 🧠 Bits, bytes, and hexadecimal representation 📉 Little endian vs. big endian 📦 Sectors and cluster sizes in file systems

But don’t worry; if these terms feel unfamiliar, I’ll be writing a separate beginner-friendly blog soon to explain all of these concepts clearly.

So buckle up this tutorial isn’t just about recovering files. It’s about peeking under the hood of how operating systems and storage really work.

Most operating systems don’t actually “erase” a file when you delete it. They just mark the space it occupies as unavailable. As long as that space hasn’t been overwritten, we can often retrieve the data manually.

This is what your activity demonstrates, by interpreting hex values directly from the pen drive image.

For demonstration i used these configuraions: Clean > MBR > Format > FAT32 > Partition > Partition name: EDUCATION

Create a folder, Create txt file named Name.txt, write anything you inside it and copy it to the pen drive and then delete it. copy any image you like( in my case i created the folder name: “LNBTI” file name: “target.png”), rename it whatever you like (but remember the file name, file name is crutial to retrieve the file from hex dump). NOTE: rename the image file before you copy into the folder.

Pen Drive
├── LNBTI
    └── target.png
    └── Name.txt

1. Taking image of the pen

dd if=\\.\PhysicalDrive1 of=disk.bin bs=4M status=progress

if: input file | of: output file | bs: Batch size

‘ \.\PhysicalDrive1 ’ means the pen drive that connected to the PC ( in your case drive number may be different, to identify the right drive number of your pen drive; Start > Search diskpart > Run as Administrator > Run command ‘list disk’. Be careful when selecting or formatting the correct drive. I will write a separate blog post on how to use Diskpart in Windows OS.

Run this command in your preferred directory in Command Prompt. After it finishes, you will see a file named disk.bin created in the same directory where you executed the command.

2. Validating MBR code

xxd -s 0 -l 512 disk.bin

you will notice the last 2 bytes contains 55AA which means this is the first record and the Master Boot Record (MBR) of the pen drive. by using this hex dump we will be able to analyze important information about the pen drive. such as DOS Partition Table (DPT).

3. Analyzing DOS Partition Table (DPT)

xxd -s 446 -l 64 disk.bin

4. Extracting Partition Hex dump

dd if=disk.bin of=part.bin bs=1 skip=2048 count=2097152 status=progress

5. Interpretating Partition hex dump

xxd -s 0 -l 512 part.bin

interpretation of partition hex dump

6. Extracting Primary FAT

figure.1

This is the structure of FAT32 file system. to extract Primary FAT (1st FAT Area; according to image) we have to skip the Reserved Area (Reserved Sectors) which we found while interpreting the Partition hex dump. Also we found out the size of the FAT32 (Sectors per FAT32)

So to extract Primary FAT run this command,

dd if=part.bin of=primaryfat.bin bs=512 skip=4110 count=2041 status=progress

Interpret the Primary FAT hex dump

xxd -s 0 -l 512 primaryfat.bin

if your Primary FAT hex dump looks like this

You’ve successfully extracted the Primary FAT hex code. In the FAT32 file structure image I provided (Figure 1), you’ll notice a Secondary FAT located right after the Primary FAT. This Secondary FAT is an exact duplicate of the Primary FAT and serves as a backup. Our next objective is to extract the Data Area (Root Directory). To do this, we need to skip the Reserved Area, Primary FAT, and Secondary FAT.

Primary FAT skip = 4110 Secondary FAT skip = 4110 + 2041 Data Area skip = 4110 + 2041 +2041 = 8192

7. Extracting Root Directory (Data Area)

dd if=part.bin of=root.bin bs=512 skip=8192 count=8 status=progress

8. Interpretation of Root Directory

xxd -s 0 -l 512 root.bin

figure 2 — root directory hex dump

As I mentioned earlier, my partition is named EDUCATION, and we have now successfully extracted its root directory. Here, I’ve highlighted the contents of the pen drive: a folder named LNBTI and a file named Name.txt. We will explore the LNBTI folder, and then, let’s retrieve the contents of Name.txt and target.png!

9. Extracting the LNBTI folder Cluster and Understanding the Root Directory Entry Let’s begin by looking at the folder named LNBTI, which is part of the root directory. You’re provided with metadata in hexadecimal format representing this folder’s entry in the file system:

First char: 4C
Remaining chars: 4E 4254 4920 2020 2020 20

✅ What this means: 4C in hex = ‘L’ in ASCII. The following values spell ‘NBTI’, padded with spaces (20 in hex). Together, these form the folder name: LNBTI.

To extract the LNBTI cluster. First we need to analyze the LNBTI Record hex values in Root Directory Hex dump ( figure 2 ).

Analyze the above hex dump using this table. highlighted 0005 is the location of first cluster. This value is important!

File Record offset table

Analyzed File Record

9.1. File Attribute and Timestamps

File attributes: 10

10 in FAT file systems indicates this entry is a directory (not a regular file).

Creation time: EC59
Creation date: 7459
Access date: 7459
Modified time: ED59
Modified date: 7459

These values are in FAT-specific date/time format and usually decoded to actual timestamps using a parser. But for this activity, you’re only expected to identify them as the creation and modification times.

9.2. Locating the File Content: First Cluster Calculation

Low order bytes of first cluster location: 0500
→ 0005

So this folder starts at cluster 5

First cluster location = Root Start + Root Size + (Cluster Number - 2) * 32 * 512

in my case: (Your skip values may be different. this may vary with your pen Drive)

= 282,624 + (5–2) 32 512 = 282,624 + 3 * 16,384 = 282,624 + 49,152 = 331,776

9.3. Extracting LNBTI Folder Cluster

dd if=part.bin of=lnbti.bin bs=1 skip=331776 count=16384

9.4. Exploring Folder Contents — Reading LNBTI Folder

xxd -s 0 -l 512 lnbti.bin

here target.png entries starting with e5 means the file has been deleted now let’s retrive that enrty and try to retrieve deleted png file. To check which cluster the target.png file is in run this command,

xxd -c 2 primaryfat.bin

target.png file is in 6th cluster (in my case 👇)

= 282,624 + (6–2) 32 512 = 282,624 + 4 * 16,384 = 282,624 + 65,536 = 348,160

dd if=part.bin of=target.bin bs=1 skip=348160 count=16384

then,

xxd target.bin

This will output a hex dump like this

now we have successfully retrived deleted image file. To view the image let’s compress the hex dump into png file so we can view the deleted image. To do that you have to run this command,

dd if=target.bin of=target.png bs=4K status=progress

Viola! Now we have successfully compressed and restored a deleted image file from pen drive. Let’s find out what the name.txt!

10. Exploring name.txt file and finding its content.

This process is also same as previous objective. first we need to find the cluster location and then calculate the skip.

10.1. searching FAT location

First char: 4E → 'N'
Remaining chars: 41 4D45 2020 2020 5458 54 → NAME.TXT

File attributes: 20 → Regular file
First cluster: 0700 → Cluster 7
File size: 1100 0000 → 0011 (hex) = 17 bytes

🔸The file starts at cluster 7. 🔸The size is 17 bytes, so it’s a tiny file. 🔸Using the same calculation method, you find the byte offset of cluster 7 and extract those 17 bytes.

xxd -c 2 primaryfat.bin

= 282,624 + (7–2) 32 512 = 282,624 + 5 16,384 = 282624 + 5 32 * 512 = 364,544

dd if=part.bin of=name.bin bs=1 skip=364544 count=16384

xxd name.bin

Yay! we have successfully retrieved the content of name.txt, now let’s compress this into txt file as usual.

dd if=name.bin of=name.txt bs=4K status=progress

Finally! Now we can rest and take a coffee break.

Congratulations! 🥳 Now you know a little bit about computer forensics!

Actually, I wrote this blog to give you a peek into how the FAT32 file system works and how operating systems function at the lowest level. This is me sharing the knowledge I gained from my university’s Operating Systems module.

I know some parts might be a bit tough to understand at first — but my advice is: keep learning the fundamentals of how computers work. It might feel hard now, but with time, it all starts to click. Trust me — anything is possible. I’m planning to write more blogs based on what I’ve learned from the OS module, so stay tuned!

If you have any questions, feel free to drop a comment below. And if there’s anything you’d like to add to this post, I’d love to hear it too.

Random Quote;

Learning is a never-ending road. You may be walking, riding, driving, or flying down that road, but no matter what state you’re in, just keep going… until you grow wings to fly on your learning journey.

Thank you Vidun Pallegoda, https://www.linkedin.com/in/vidun-nethdina/