linux disk editor/fat tarbal recover [time running out :( ]

["Richard E. Hawkins" <reh18@psu.edu>]

Once more, I'm trying to recover data from a tarball on a fat partition,
but
time is running out--I have to file my tax return by October 15, and so
I need 
to recover at least a week ahead of that (or I'll have to do it all
again,
and this is a big, ugly, return with lots of schedules :(   )

Roughly, I created a primary fat partition, tarred /home onto a tarball
on it,
deleted the partition, and tried to resurrect it as an extended
partition.  

I've learned so far that this wipes out the fat, whcih is a bad thing :)

The good news is that (I think) the tarball, which was uncompressed,
should be 
the first file on the partition, so the file should be contiguous.  No
files 
have been written to the partition since then. I've come to understand
that 
if I find one piece of it, I should be able to find therest. 

I've installed the hard drive into another machine to work with. I've
used dd
to copy a primary fat partition placed in the same place as the lost
partition.
I've used dd to copy the file to "recovery.2", and split that into 100M
pieces 
[having discovered that you can kill the system by trying to load a 1.7G
file 
into beav :) ]

I am now running a script "grepall" which reads

#! /sbin/sh

for file in `ls x*` ; do
  echo $file
  strings $file | grep -e "/home"  -e"hawk" > grep.${file}
  done

This is based on the premise that the first two lines of the tarball
should be
something like

/home
/home/hawk

It's clear that I'll get a match in grep.xaa like this.  It doesn't have
all the entries I'd expect, though.  Once I hit the tarball, I should
get lots.

This locates the file to within 100MB..  I could just recursively search
at
that point, but that would just beg the question.   So what do I do once
I 
find which one has my tarball (or at least the beginning?)

I've compiled lde, the only disk editor I could find on freshmeat.  But 
I have no idea what to do with the information.  I assume that somehow I
create a new file starting at the correct location and untar it.  But
how do 
I do this?

hawk, running out of time



-- 
Prof. Richard E. Hawkins, Esq.       Smeal 178    (814) 375-4700
dochawk@psu.edu
These opinions will not be those of Penn State until it pays my
retainer.