Re: [OT] undeleting on FAT32
sean finney wrote:
> first, just because i think *someone* should say it,
>
> On Fri, Nov 22, 2002 at 12:58:15AM +0100, Tim Dijkstra wrote:
> > On Thu, 21 Nov 2002 23:31:51 +0000
> > "Joshua Thomas" <work_thomas@hotmail.com> wrote:
> >
> > > kill your girlfriend, then kill yourself.
>
> that was completely unnecessary and unhelpful, please don't waste our
> bandwidth, disk space, and time.
Yes. Thank you. The file probably wasn't _that_ important.
> anyway, i'd be interested to hear what everyone has to say about
> this. about a year ago i deleted two files that were very important
> to me on a vfat mounted partition while in linux. i immediately
> mirrored the entire partition over netcat to another computer, on whose
> disk the image still resides, hoping that some day i'll be able to
> restore the files from their cryogenic sleep.
>
> i could probably find the raw offset of the file since i know the
> first 4 bytes--as well as how to tell if those four bytes describe
> a valid candidate (they were quicktime .mov files), but don't
> know enough about FAT32 or available utilities for said fs to be
> able to get it if it's fragmented around. anyone know of any good
> utilities/links-with-information?
For that sort of thing, if the file is fragmented, you're probably more
or less out of luck. What you'd probably want to do is build a map of
the unallocated clusters on the partition, starting with the first
cluster of the file (which you can still get from its directory entry).
If you're lucky, the free blocks coming after the file's first cluster
will be the file (or obviously not the file, e.g. those that contain
deleted small text files or other obviously "not the droids you're
looking for" stuff). Unfortunately, the FAT filesystem retains no
information about the location of a file's blocks other than the first
one.
Even with Norton Utilities (as of the last time I saw it, which was
roughly around the time I stopped being one of its developers),
recovering large files was a bit of a pain. It would usually resort to
showing you raw sectors one by one and asking if you thought this might
be part of your file -- essentially just semi-automating the task I
described above.
Craig
Reply to: