Is it possible to spoof a microSD FAT32 filesystem?
Attempting to fully emulate the behavior of a microSD card in a way that will work with all devices that might try to use it is apt to be difficult without some specialized circuitry and a lot of work.  On the other hand, many devices which make use of microSD cards don't use all of their features, and communicate at a rate significantly below the maximum allowable rate for SD cards.  Consequently, it may be possible to use a data analyzer to see which SD-card commands and features are actually used by the application of interest and focus on emulating those.

There are two approaches one might take to the task of capturing output:


Have a device which behaves like a microSD card and allows arbitrary files to be stored upon it, and then have some parallel process which examines the contents of the card.
Have a device which behaves like a microSD card which has a fixed pattern of data stored upon it in fixed places, and rely upon the fact that a particular device which tries to write data will do so in predictable fashion.  I haven't seen this approach used for microSD, but openSDA uses it for USB mass storage devices, and I think the same principle could work with microSD.  For example, if a device always writes a file by writing a directory entry with zero size, then writing to available clusters in numerical order, and finally writing the directory entry with an updated size, a device which sees a write to a directory entry followed by a write of some data clusters followed by another write to the directory could interpret that sequence of events as creating a file of the specified size holding the specified data.


If one couldn't afford much flash storage, the second approach could allow one to get by with less than the first, especially if one wanted to extract only some of the information that had been written to files.  The first approach would require more mass storage, but the placement of new data on disk would vary according to the placement of previously-written data.  By contrast, it's possible that the software which writes to the disk might behave absolutely consistently and predictably if the results of trying to read the disk never change.  If the first directory entry always reads as blank, and the first 20 clusters always read as available, an attempt to write a file might always read the first directory entry, see that it's available, and use it, then check the availability of the first 20 clusters, see that they're available, and use them.  If the firmware of the device you're interfacing with isn't likely to change, such behavior might simplify the task of capturing data from it.