cybersecurity · intermediate · ~15 min · safe pentest lab

Recover an 8.3 filename from a FAT directory entry

Fixed-layout filename reconstruction with a sentinel-byte rule.

Challenge

Reconstruct a printable 8.3 filename from the raw bytes of a FAT directory entry, applying the 0xE5 deleted-entry convention that recovery tools rely on.

Task

Implement int recover_8_3(const uint8_t *entry, char *out).

entry points to a FAT directory entry whose bytes 0..10 hold the 8.3 short name: 8 base-name bytes then 3 extension bytes, space-padded ASCII. Build the filename in out following these rules:

  • if entry[0] == 0xE5, render the first character as '_' (deleted-entry marker);
  • trim trailing spaces from the base and the extension separately;
  • if the trimmed extension is empty, omit the .;
  • uppercase all ASCII letters;
  • NUL-terminate out and return the number of bytes written (excluding the NUL);
  • return -1 if entry or out is NULL.

Input

  • entry: a pointer to the entry's bytes the grader provides (only bytes 0..10 are read). May be NULL.
  • out: an output buffer of at least 13 bytes. May be NULL.

Output

Returns the number of bytes written excluding the NUL, or -1 if either pointer is NULL.

Example

base "HELLO   ", ext "TXT"            ->   "HELLO.TXT"     (9)
base "README  ", ext "   "            ->   "README"        (6, no ext)
entry[0]=0xE5, rest "ELLO    " "TXT"  ->   "_ELLO.TXT"     (9)
base "mixed   ", ext "asm"            ->   "MIXED.ASM"     (9, uppercased)

Edge cases

  • Empty extension: the . is omitted.
  • A deleted entry (entry[0] == 0xE5): first character becomes _.
  • entry or out is NULL: return -1.

Rules

  • Read only bytes 0..10. Output is at most 13 bytes (8 + 1 + 3 + 1). Uppercase ASCII.

Why this matters

The 0xE5 deletion convention is what every FAT recovery tool uses to list deleted files. Reproducing it in C makes the rule concrete.

Input format

A pointer to the entry's bytes (only 0..10 read; may be NULL) and a >=13-byte out buffer (may be NULL).

Output format

Bytes written excluding the NUL, or -1 if entry or out is NULL.

Constraints

Output up to 13 bytes (8 + 1 + 3 + 1); uppercase ASCII; read no further than byte 10.

Starter code

#include <stdint.h>
int recover_8_3(const uint8_t *entry, char *out) {
    /* TODO */
    (void)entry; (void)out;
    return -1;
}

Common mistakes

Forgetting trailing spaces. Including the dot when extension is empty. Mishandling the 0xE5 rule (it applies only to position 0).

Edge cases to handle

No extension. Maximum-length 8 + 3 name. Deleted entry that's also lowercase before deletion.

Complexity

O(1) — at most 12 bytes processed.

Background lessons

Up next

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.