exFAT Recovery: Directory Entries and FAT Chains
exFAT stores a directory entry set per file and a FAT chain for allocation. Both are recoverable from an image.
Structure
Each file has an entry set (file entry, stream extension, name entries). Cluster chains live in the FAT with the 'no next cluster' marker ending a file. Deleted entries lose the in-use bit, leaving name and size readable.
Recovery
Parse directory entries, follow FAT chains, then rebuild contiguous and fragmented files; verify with file signatures. Cards that were formatted in-camera often keep most entries.
FAQ
Why do photos come back with generic names?
Name entries are lost or reused; content is recovered by signature instead.
Do in-camera formats erase data?
Quick formats usually reset metadata only.