Re: Undeleting from a FAT partition

[Richard Lyons <richard@the-place.net>]

On Sunday 17 August 2003 6:05 pm, Neilen wrote:
[...]
> Thanks, this worked a charm.  I happened to know the names of the files
> I wanted to undelete, since they were just dscf0000.jpg, etc.  But how
> could one find out what the possible undeletable files are?

It's a very long time ago since I used to mess around with FAT floppies on my 
first msdos machine, but I recollect the directory is a simple fixed-width 
array (on floppies it was on the middle track IIRC) with the filename at or 
near the beginning of each entry.  When deleted, the first characer of the 
filename was replaced by a null.  If that applies still, all you need to do 
is scan the data with a hex editor, looking for a likely array.  Or search in 
a hex editor for the name of one file that you know is there, less its 
initial character.  The filenames are padded with space characters 0x20 so 
searching for a short string of them might find somewhere in the directory.  
A (very) old Norton instruction manual will tell you more.

-- 
richard