I've recently been tinkering with deleting text files and seeing what information I can gather from the clusters that those files used to be on. However, I've hit something that's really made me scratch my head... DiskView is reporting that the first unallocated block (I like to call them clusters) on a FAT drive is on cluster 32269.

I've included this image which confirms that. I've included this image which confirms that. However, when I used WinHex to look at what information was left behind in cluster 32269, the program reported that it was occupied by a file that was on my disk.

This is what WinHex reports

This is what WinHex reports. Why does DiskView state this cluster is unoccupied, when WinHex thinks an actual "live" file (not deleted) is within the cluster? I scrolled down somewhat in WinHex, and according to that program the free space (its word for unallocated clusters) doesn't start until cluster 32273.

It's almost like the file on my disk is bleeding into 4 clusters it isn't supposed to be in, but I was under the impression that such a thing was impossible. Am I seriously misinterpreting these results, or is there something incredibly wrong here?

UPDATE: As requested, here's how WinHex displayed cluster 32273. I've also correlated WinHex displays between cluster 32270 - 32273. The bytes per cluster is 1,024 and the bytes per sector is 512. The LesMiserables1 file is what DiskView thinks should be ending at cluster 32268, with clusters 32269 and over being free space. As seen in the combined image, WinHex states it actually ends at 32270 and shows the tail end of its volume slack.

  • Have you taken a new "Snapshot" of the volume in WinHex after you deleted the file? – Tom Yan Apr 3 '16 at 10:51
  • Also can you show how exactly did it show the free space/unallocated clusters (at 32273) you mentioned? Which part did you exactly scroll down? Sounds like you are seeing the "volume slack" (the unused space of the last allocated cluster for that file)? It will be helpful if you can show the Bytes per cluster of the volume and the file size of the delete file. – Tom Yan Apr 3 '16 at 11:07
  • RE Tom - The file was deleted quite some time ago, and I had never launched WinHex before that - so the volume information would have been up to date. I've updated the post to include the information you included - except for the file size of the deleted file. – Tyrx Apr 3 '16 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.