Re: [OT] undeleting on FAT32

[Craig Dickson <crdic@pacbell.net>]

sean finney wrote:

> On Fri, Nov 22, 2002 at 08:01:13AM -0800, Craig Dickson wrote:
> > For that sort of thing, if the file is fragmented, you're probably more
> > or less out of luck. What you'd probably want to do is build a map of
> > the unallocated clusters on the partition, starting with the first
> > cluster of the file (which you can still get from its directory entry).
> 
> okay, i really know nothing about the inner workings of fat32...  how
> would i do both of these things?

If you still have a Windows machine and the file really matters that
much to you, the simplest approach would be to pick up a copy of Norton
Utilities and use the UnErase wizard. No guarantees, but that's probably
the best way to go.

Failing that, you need a program that will let you look at individual
sectors on the hard disk. Read up on the FAT filesystem's structure.
Short version: at the start of the partition, there is a boot sector
followed by two copies of the FAT (File Allocation Table). Following the
FAT is the data area, which consists of clusters; each cluster is a
fixed- size group of sectors (the sectors-per-cluster value is contained
in the boot sector). Each entry in the FAT is either a constant, the
value of which I forget, that means "this cluster is unallocated", or
the index of the next cluster in that file. So the way you find all of a
file that hasn't been deleted is to get the first cluster number (C1)
from the file's directory entry, then get the second cluster number (C2)
by looking at index C1 in the FAT, and so on until you get to a FAT
entry containing the "end of file" constant (the value of which I also
forget -- it's been about ten years since I had a reason to care).

What I'm suggesting here is that you get a list of all the cluster
indices for which the corresponding FAT entry says "unallocated", then
look up the deleted file's directory entry to get its first cluster
number. Figure out how many clusters the file should occupy (its size in
bytes should still be in the directory entry, I think). Look at the
clusters on disk one by one, starting with the first cluster of the file
and then moving on to subsequent unallocated clusters. If they look like
they might be part of your file, append their contents to a new file
that you create on another partition. If you're lucky, at the end of
this process you'll have your file back. But quite possibly you won't,
because there's no guarantee that you've accurately chosen all the right
sectors if the file was fragmented.

Craig