How to know if the block (cluster) where the e-trace is found is currently in use by an existing file.

All file systems use an area mapping all clusters on the volume.

NTFS and exFAT use a bitmap file, where each block (cluster) is represented by a single bit. If the bit value is 1, then the associated cluster is allocated to a file, if value is 0, the cluster is considered as unused. 

FAT16 and FAT32 use the FAT area to represent the cluster. If the 2 (FAT16) or 4 (FAT32) are full of 0x00, then the associated cluster is considered as unused, otherwise, the cluster is or allocated, or marqued as bad.

By allowing to « select » to the « bit level », Tyrhex helps the user to jump from a cluster to the associated bitmap position and from a bitmap position to the associated cluster.

Moreover, the block (cluster) number color helps to know if this block is currently allocated (blue) or unallocated (gray)

When showing list of blocks for a specific file of folder, each list allocation is performed, A means that all blocks into this list are allocated, U means that none of them is allocated and the other sign means that some are, other aren’t.

tyrhex © Yves Vandermeer  2015-2017   #tyrhex