Reconstituting headers for MS binary compound files RRS feed

  • Question

  • Dear All,

    I am trying to reconstitute the 512-byte headers for *xls / *.doc / *.ppt binary compound files after a virus attack. I've been able to arrive at most of the values from MS documentation and from the uncorrupted data but I'm stuck on 1st miniFAT sector ID at offset 60, and number of miniFAT sectors at offset 64.

    The documentation implies that there is a link between these values and the values for starting sector and stream size given in the root directory.

    Can anybody advise?

    • Edited by piglet 65 Monday, February 17, 2014 6:09 PM
    Monday, February 17, 2014 6:08 PM