Re: finding a tarball on a fat-less fat partition
> It was a brand new partition, and only two files should ever have been
> written there (tars of /home and /etc), so I presume that they were
> written continuously.
> Any suggestions on how to recover these?
recover with dd. the better question is, how to find them. if you've
overwritten only the fat, than the problem is not that big: the fat is
used only to find the second and following clusters of a file; the first
cluster is stored in the directory, from which the file is referred to.
so you might find the starting sector of the file using some low-level
disk browser (like the diskedit for dos). there are also some disk editors
for linux, but they all suck more or less (pointers to _really_ good editors
are welcome). diskedit also has a string search function, so you might
search for the tar magic (or some filename at the beginning of the archive)
if more than the fat is destroyed.
Hi! I'm a .signature virus! Copy me into your ~/.signature, please!
Real programmers don't comment their code.
It was hard to write, it should be hard to understand.
Become part of the world's biggest computer cluster -