A Diagram of the Directory Entry
for "cover page.jpgc"

 

The following table shows all the hex bytes for the Directory entry of COVERP~1.JPG and its Long File Name ("cover page.jpgc          ").

See below for an explanation of the color-coding used here; for example, the light-red cells show the illegal or problematic values for this file entry. The reason all eleven of the SPACES (20 00 hex; Unicode) in the 3rd part are illegal  is because the last character of any Microsoft LFN can not be a SPACE. If the very character for this LFN (see the 20 hex in bold) were valid, say an "e" (65 00 hex), then all ten of the previous spaces would become valid characters and the LFN would be acceptable.

According to this entry, the Beginning Cluster Number for the file is 420 (01A4 hex), but the file itself can clearly be seen in the diskette image as being between the deleted .doc file (which begins at cluster 2) and the disguised .ZIP file (which starts at cluster 73). Checking the FAT (File Allocation Table), shows that this entries file is located at clusters 42 through 72 inclusive. This Directory entry was probably changed with some type of disk editor or other utility program that lists clusters in decimal (a change from  42  to 420) rather than in hexadecimal (002Ah  to  01A4h). A good disk editor program will show all of the data presented here (and more) and make it easy to change as well.

KEYS to the chart above:
For any Long File Name entry requiring three parts, the bytes in the light-blue cells will always be the same. The light-green cells show the valid ASCII or Unicode bytes (for this LFN) which represent the characters you see below them. The F4 byte in the violet cells is the 'checksum' for the filename COVERP~1.JPG. The meaning of other important bytes is appended to the 1st Part; such as:

C. Time/C. Date = File Creation Time/Date,
M. Time/M. Date = File's Modified Time/Date,
A. Date = File's Last Accessed Date.
 ___________________
*Although it seems rather suspicious that the file's Creation time ( 8:50 AM ) is later than its last Modified time ( 8:30 AM on the same day), one explanation might be that the diskette was moved from the computer it was created on to another that had its clock set to more than 20 minutes earlier than the first. ( I know from experience that the clocks in computers at public libraries can be many hours off from the correct time! )