From fnaumann@mail.cs.uni-magdeburg.de Thu Aug 26 09:05:57 2004 Subject: Re: [MiNT] Bad News From: Petr Stehlik To: mint@lists.fishpool.fi In-Reply-To: <1093501528.8481.4.camel@pikachu.atari-source.com> References: <1093501528.8481.4.camel@pikachu.atari-source.com> Content-Type: text/plain; charset=iso-8859-2 Message-Id: <1093503103.5613.12.camel@joy.sophics> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 26 Aug 2004 08:51:43 +0200 X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at sophics.cz Delivered-To: mint@lists.fishpool.fi X-ecartis-version: Ecartis v1.0.0 Sender: mint-bounce@lists.fishpool.fi Errors-to: mint-bounce@lists.fishpool.fi X-original-sender: joy@sophics.cz Precedence: bulk List-help: List-unsubscribe: List-ID: X-List-ID: X-Milter: ClamAV 0.70/0.70kjel X-Milter: milter-regex 1.5jel X-Milter: ClamAV 0.70/0.70kjel X-Milter: milter-regex 1.5jel Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by prinz.cs.uni-magdeburg.de id i7Q75fIa021957 V Čt, 26. 08. 2004 v 08:25, Mark Duckworth píše: > I was wondering, since there was no writes other than the rm -rf /* > (seemingly), is there any way to recover this data or is cluster sizes > and such gone? I tried an undelete tool and it didn't give me much to > restore and so I didn't touch it at all. It's a FAT partition. on a FAT fs removing a file is a mere FAT table clearing. Also first character of the filename is lost. That's all. Restoring deleted file(s) consists of the following steps: 1) locate the filename in directory entries and fix the first character 2) go to the first cluster of the file and try to find the next one (with good luck and well optimized filesystem (unfragmented) it's the following cluster). If you find it, fix the chain in the FAT table and continue until you restore the whole file. Best do this on a disk image of the original disk so if you make something wrong you can roll back easily. In short - all data is there, all filenames, all file sizes. You just need to concatenate the right clusters to get the whole file. If you lost whole disk (thousand of files?) and it was fragmented already this might take weeks of work (for text files - binary files are hardly restorable this way). Petr