dump.exfat

exFAT filesystem information display

TLDR

Print on-disk information for exFAT filesystem

$ dump.exfat [/dev/sdXY]

Show directory entry information for a specific path

$ dump.exfat -d [/path/to/file] [/dev/sdXY]

Scan directory entries from a given path recursively

$ dump.exfat -s [/] -r [/dev/sdXY]

Show cluster chain along with directory entries

$ dump.exfat -d [/path/to/file] -c [/dev/sdXY]

Print version information

$ dump.exfat -V

SYNOPSIS

dump.exfat [-d file-path] [-s dir-path] [-r] [-c] device

dump.exfat displays detailed on-disk structural information for exFAT (Extended File Allocation Table) filesystems. It reads and presents filesystem metadata including boot sector parameters, FAT (File Allocation Table) region layout, cluster sizes, volume serial numbers, and other low-level details.The tool is primarily used for forensic analysis, debugging filesystem issues, and understanding exFAT structure. It reveals information like volume label, filesystem version, bytes per sector, sectors per cluster, FAT offset and length, cluster heap offset, and root directory location.exFAT is commonly used on flash media (SD cards, USB drives) and external drives due to its support for large files and broad compatibility across Windows, macOS, and Linux. dump.exfat helps diagnose corruption, verify filesystem parameters, and analyze how data is organized on the storage device.The tool operates as a read-only utility and does not modify the filesystem. For accurate results, the filesystem should ideally be unmounted, though read-only access to mounted filesystems is possible.

PARAMETERS

-V

Print version and exit.

-d, --dentry-set=path

Print directory entry information for a given path on the device.

-s, --scan-dir=dir-path

Scan and print directory entry information from a given path.

-r, --recursive

Scan directory entries recursively. Only works with -s.

-c, --cluster-chain

Print cluster chain information alongside directory entries. Only works with -d or -s.

device

The device containing the exFAT filesystem.

CAVEATS

Part of exfatprogs package. Read-only operation. Absence of doubly-allocated clusters does not guarantee they are not doubly-allocated unless scanning starts from the root directory recursively.