[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] undeleting on FAT32



On Thu, 21 Nov 2002 16:01:31 -0800, Craig Dickson <crdic@pacbell.net>
wrote:

>Osamu Aoki wrote:
>
>> I used to undelete DOS file by changing first byte of filename at the 
>> directory entry list from 0x5F or something to ordinary character.
>> 
>> Then you get back DOD file.  (Floppy and not in subdirectory, but it
>> should wok similarly...)
>
>That isn't close to being sufficient. It restores the directory entry,
>but it doesn't reallocate the file's sector clusters, nor does it
>re-establish the linkage from one cluster to the next. If the file is
>more than one cluster long, you have no way of knowing where the rest of
>it is. With a sector editor, you may be able to find it, particularly if
>you're lucky and the file wasn't fragmented, or if you know what the
>file's contents look like. (Good luck if it's some binary format without
>much readable text in it.)
>
>Craig

The magic character is E5. (not E6) The deleted directory entry still
stores the starting cluster number, and looking through the FAT for
clusters with entry 0 starting at that cluster gives you some chance,
though I admit it's a pain. Bad luck that it's a gzip but you still
stand a chance if there weren't any other gzips using adjacent parts
of the disk that have also been deleted. Look at some known gzips in
hex first and get a feel for what they look like (somewhere between
"code" and "random").

Pigeon



Reply to: