The cluster chain that a file entry points to remains in tact after the file is deleted. The opposite, however, occurs for directories. Upon deleting a directory entry, the first cluster that the entry points to has a FAT table value of that represents that the cluster is unused instead of the EOF marker or the number of the next cluster in the chain. This makes it difficult to recover deleted directory information beyond the first cluster.
Using a trained eye, some directories can be fully reconstructed. Take, for example, the following case:
You want to recover a directory, but only the first cluster can easily be identified. Upon examination of the contents of this cluster, you find that the last few directory entries are the files MYFILE1.TXT, MYFILE2.TXT, and MYFILE3.TXT. Seeing as how the cluster is completely used by entries, your keen skills and experience lead you to believe that there is more to this directory than this cluster. You search for lost cluster chains in the file system. You then sift through the list, eliminating those which do not appear to be directory data. Out of the remaining lost chains, you notice that one of them starts with the files MYFILE4.TXT and MYFILE5.TXT. You make note of the starting cluster of that chain. Then you edit the FAT table and change the entry for the first cluster of the directory from unused to the cluster number of the newly found chain. You take a moment to gaze upon your victory, as you have just successfully reconstructed a deleted directory.
Each sub directory begins with two entries. One entry for the current directory (the . entry), and one entry for the parent directory (the .. entry). Another technique to find sub directories that may be missed by other methods is to search for one of these entries in free clusters. These entries can be uniquely identified by a single dot followed by ten spaces or two dots followed by nine spaces. This is due to the fact that the file name field of a directory is eleven characters long. See Directory Entries.