To undelete a file in the FAT file system, EnCase obtains the starting extent from the:
FAT
File header
Operating system
Directory entry
Submit