I'd like to introduce FATX-Tools, which are some tools I wrote that may help some of you find some extra goodies in your XBOX and X360 hard drives. These are data recovery tools that can help some of you find and recover deleted content. They handle both dev and retail drives.
I also need to mention that these tools are not exactly finished, but they have helped some people recover some interesting data in the past.
- You will need to have created an image of your hard drive. Make sure that this image is uncompressed before using these tools.
- You will need Python 2.7 installed. The exact version used to develop these tools can be found here: https://www.python.org/downloads/release/python-2716/
- Then you need to download FATX-Tools from my repo here: https://github.com/aerosoul94/fatx-tools
Run main_gui.py in a command prompt like so
From there you open your image file within the GUI and it will display the current file system of files that have not been deleted.
At this point you would right click any partition to perform actions upon it as shown above.
The Recover File System option will only extract the current contents of the file system. This does not recover deleted files.
It's important to understand that undeleted file contents are never guaranteed as file data may have been overwritten. Now I need to explain the differences of each method of analysis.
Note that above, the "ears_godfather" folder was marked as deleted. The results of the orphan analyzer gives us what appears to be deleted contents of what may have existed somewhere within that folder.
Once again, these tools are not finished. If you have any questions or would like to report a bug please do so below or post an issue in the Github repo.
I also need to mention that these tools are not exactly finished, but they have helped some people recover some interesting data in the past.
- You will need to have created an image of your hard drive. Make sure that this image is uncompressed before using these tools.
- You will need Python 2.7 installed. The exact version used to develop these tools can be found here: https://www.python.org/downloads/release/python-2716/
- Then you need to download FATX-Tools from my repo here: https://github.com/aerosoul94/fatx-tools
Run main_gui.py in a command prompt like so
python main_gui.py.From there you open your image file within the GUI and it will display the current file system of files that have not been deleted.
At this point you would right click any partition to perform actions upon it as shown above.
The Recover File System option will only extract the current contents of the file system. This does not recover deleted files.
It's important to understand that undeleted file contents are never guaranteed as file data may have been overwritten. Now I need to explain the differences of each method of analysis.
- Orphan Analysis - This method searches for file system meta data called dirents. A dirent is created for each file or directory that is (or was) in the file system and contains information about this entry. A dirent contains the file's name, file attributes, file size, the file's time stamps, and the file's location in the hard drive. As these dirents are not erased once deleted, the information mentioned is still available making recovery a possibility.
- Signature Analysis - This method is also known as file carving. It searches for files based off of their "signatures". An example would be the "magic" usually present at the beginning of a file to indicate what type of file it is (e.g. "XBE", "XEX2"). This type of analysis is not as reliable when it comes to recovering specific file meta data such as the name and timestamps. It tries to extract a name, if present within the file, and guess a file size based off of information from the file format. This is most useful when the dirent may have been overwritten though the file contents still exist.
Note that above, the "ears_godfather" folder was marked as deleted. The results of the orphan analyzer gives us what appears to be deleted contents of what may have existed somewhere within that folder.
Once again, these tools are not finished. If you have any questions or would like to report a bug please do so below or post an issue in the Github repo.
Last edited:
