[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT] undeleting on FAT32



On Fri, 22 Nov 2002 16:45:45 -0800, Osamu Aoki <osamu@debian.org>
wrote:

>On Fri, Nov 22, 2002 at 03:18:51AM +0000, Pigeon wrote:
>
>Yah, I think at one point I wrote short special HEX dump utility of
>clusters :0  (You know 12 bit = 8 X 1.5 table)

Yeah, FAT32 is easier, no need to unpack it.

>By the way, there is easy way.  Use "undelete" command to recover these
>lost files.

If you haven't been using mirror or something, all undelete can do is
automate the process we're talking about, probably with less chance of
success...

>> though I admit it's a pain. Bad luck that it's a gzip but you still
>> stand a chance if there weren't any other gzips using adjacent parts
>> of the disk that have also been deleted. Look at some known gzips in
>> hex first and get a feel for what they look like (somewhere between
>> "code" and "random").
>
>I have not done it lately but 8086 code usually have PQRTS in ascii
>dump.  (POP/PUSH from/to stack things). 

Yeah, it does. gzips don't, which helps distinguish them from the most
likely kind of interspersed gobbledegook. gzips look sorta like a
cross between PIC and 6502 code, but more random (the closer to noise
it is, the more effectively the bandwidth is being used).

On Fri, 22 Nov 2002 10:36:20 -0800, Craig Dickson <crdic@pacbell.net>
wrote:

>sean finney wrote:
>
>> On Fri, Nov 22, 2002 at 08:01:13AM -0800, Craig Dickson wrote:
>> > For that sort of thing, if the file is fragmented, you're probably more
>> > or less out of luck. What you'd probably want to do is build a map of
>> > the unallocated clusters on the partition, starting with the first
>> > cluster of the file (which you can still get from its directory entry).
>> 
>> okay, i really know nothing about the inner workings of fat32...  how
>> would i do both of these things?
>
>If you still have a Windows machine and the file really matters that
>much to you, the simplest approach would be to pick up a copy of Norton
>Utilities and use the UnErase wizard. No guarantees, but that's probably
>the best way to go.
>
>Failing that, you need a program that will let you look at individual
>sectors on the hard disk. Read up on the FAT filesystem's structure.

Norton Utilities for the versions of Windoze that use FAT32 and are
DOS-based (eg. 98) contains a DOS-mode program called DISKEDIT.EXE
which can do this. Stick a blank floppy in and format A: /s from the
Win98 DOS prompt, copy DISKEDIT.EXE onto it, boot from the floppy and
hack your hard drive as much as you want. It lets you view
directories, FATs, partition tables etc. either in raw hex or with the
data sensibly interpreted so you can read it.

Warning: never use Norton Disk Doctor to repair a problem, cos it
usually makes it worse.

Pigeon



Reply to: