Re: finding a tarball on a fat-less fat partition--disk editor? (fwd)
> > i said, they suck, not that they are bad. this means, that they are not
> > that simple to use as diskedit for dos and lack the one or other
> > interesting feature - at least the last time i looked out half a year ago.
> > ;-)
>
> For one-use once, i'll put up with almost anything. I assumee I only
> need to browse a couple of k, anyway. But what are they called?
> grepping /var/lib/dpkg/available for disk.*edit doesn't yield anything.
>
well ... i don't remember their names. i found some of them by searching
freshmeat.net and doing a generic web search for "linux disk editor" or
something like that. i did not bookmark them, as they all were not very
satisfactory ... :-(
> > > I just realized that I can't use the same
> > > method I sed on an ext2 on a fat (unless it grew inodes while I wasn't
> > > looking :)
> > ??
>
> there's a how-to that explains brute-force inode searches on ext2
> partitions. I recovered some important files from another machine this
> way a few weeks ago.
>
i see. well - that's the big difference between the (primitive) cp/m-like
filesystems, which store allocation data in directory entries, and the
(more complex) unix-like filesystems which use i-nodes.
on a unix-system you can search for deleted nodes - if you find any,
you have a good chance of recovering them (if the disk was not filled after
the deletion), but you'll never know, what the original name of the file
was (without guessing it by inspecting the contents).
(btw: i'm not really sure, that the allocation info in an inode is completely
preserved when it is marked as deleted (i did not read the how-to), but as
i see no reason to clear it ...)
on fat and similar systems you can completely (aside from the first letter
of filenames, as anybody who ever used undelete knows) restore the hierarchy
by recursively traversing the directories marked as deleted. but this works
only if the files were not fragmented, as the allocation chains in the fat
are cleared while a file is deleted.
regards
--
Hi! I'm a .signature virus! Copy me into your ~/.signature, please!
--
Real programmers don't comment their code.
It was hard to write, it should be hard to understand.
--
Become part of the world's biggest computer cluster -
join http://www.distributed.net/
Reply to: