Crate fat

Expand description

fat-core: pure-Rust forensic reader for FAT12/16/32 and exFAT.

Imported as fat ([lib] name = "fat"). FatFs::open auto-detects the variant from the boot sector and exposes uniform navigation across all four.

Structs§

FatFs: A pure-Rust reader over a FAT12/16/32 volume.
FatTimestamp: A decoded FAT timestamp as seconds since the Unix epoch plus a sub-second remainder. The value is wall-clock local time (FAT carries no zone).
Geometry: Resolved on-disk geometry of a FAT12/16/32 volume. All byte offsets are relative to the start of the volume (sector 0).
Node: A resolved node: identity plus the fields a caller needs to navigate or read.

FatError: Errors raised while opening or navigating a FAT/exFAT volume.
FatVariant: Which member of the FAT family a volume is.
FileId: A handle to a node. The root is distinct; every other node is addressed by its parent directory’s first cluster plus its 32-byte slot index — so the entry (including a deleted one) can always be re-read from the structure.

boot_checksum: The four-byte boot-region checksum over the first 11 sectors, excluding the VolumeFlags (offsets 106, 107) and PercentInUse (offset 112) fields ([MS] §3.4). A mismatch against the stored checksum is a tamper signal.
parse_exfat_boot: Parse the exFAT main boot sector into a Geometry (variant FatVariant::ExFat). data_start is set to the cluster-heap offset so the shared cluster_offset maps clusters uniformly with the FAT path.