RE: [OT] undeleting on FAT32
> -----Original Message-----
> From: Craig Dickson [mailto:crdic@pacbell.net]
> Sent: Friday, November 22, 2002 10:36 AM
> To: debian-user@lists.debian.org
> Subject: Re: [OT] undeleting on FAT32
>
........
> What I'm suggesting here is that you get a list of all the cluster
> indices for which the corresponding FAT entry says "unallocated", then
> look up the deleted file's directory entry to get its first cluster
> number. Figure out how many clusters the file should occupy (its size in
> bytes should still be in the directory entry, I think). Look at the
> clusters on disk one by one, starting with the first cluster of the file
> and then moving on to subsequent unallocated clusters. If they look like
> they might be part of your file, append their contents to a new file
> that you create on another partition. If you're lucky, at the end of
> this process you'll have your file back. But quite possibly you won't,
> because there's no guarantee that you've accurately chosen all the right
> sectors if the file was fragmented.
>
Just to add a random thought here:
IIRC gzip has an internal checksum and can be validated quickly. You can, if
you have lots of time and this is life & death, essentially use brute force
attack on your candidate sector lists. For example if the file should be 10
clusters long and you have 25 candidates, it should be easy to generate the
(uh... 25 choose 10...) 3268760 candiate lists, then test the checksum on
each one (essentially "gzip -c testfile > /dev/null || echo 'nope. next!') .
This would involve script fu, use of dd, and heavy amout of disk IO but it
isn't rocket science. This would be a last resort effort since it could take
a long time and the most obvious linear candidates will probably be correct.
You should also check the file format for gzip. The first sector will have
the magic number and possibly the length. There might also be some
recognizable magic in the last sector as well.
Just how much is this file worth? Or is it just an interesting challenge at
this point?
Reply to: