From fnaumann@mail.cs.uni-magdeburg.de Thu Aug 26 09:08:33 2004 Subject: Re: [MiNT] Bad News From: Mark Duckworth To: mint@fishpool.com In-Reply-To: <1093503103.5613.12.camel@joy.sophics> References: <1093501528.8481.4.camel@pikachu.atari-source.com> <1093503103.5613.12.camel@joy.sophics> Content-Type: text/plain; charset=iso-8859-2 Message-Id: <1093503579.8472.10.camel@pikachu.atari-source.com> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.6 Date: Thu, 26 Aug 2004 02:59:40 -0400 Delivered-To: mint@fishpool.com Delivered-To: mint@lists.fishpool.fi X-ecartis-version: Ecartis v1.0.0 Sender: mint-bounce@lists.fishpool.fi Errors-to: mint-bounce@lists.fishpool.fi X-original-sender: mduckworth@atari-source.com Precedence: bulk List-help: List-unsubscribe: List-ID: X-List-ID: X-Milter: ClamAV 0.70/0.70kjel X-Milter: milter-regex 1.5jel X-Milter: ClamAV 0.70/0.70kjel X-Milter: milter-regex 1.5jel Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by prinz.cs.uni-magdeburg.de id i7Q78HEX022062 On Thu, 2004-08-26 at 02:51, Petr Stehlik wrote: > V Čt, 26. 08. 2004 v 08:25, Mark Duckworth píše: > > I was wondering, since there was no writes other than the rm -rf /* > > (seemingly), is there any way to recover this data or is cluster sizes > > and such gone? I tried an undelete tool and it didn't give me much to > > restore and so I didn't touch it at all. It's a FAT partition. > > on a FAT fs removing a file is a mere FAT table clearing. Also first > character of the filename is lost. That's all. Restoring deleted file(s) > consists of the following steps: > > 1) locate the filename in directory entries and fix the first character > > 2) go to the first cluster of the file and try to find the next one > (with good luck and well optimized filesystem (unfragmented) it's the > following cluster). If you find it, fix the chain in the FAT table and > continue until you restore the whole file. > > Best do this on a disk image of the original disk so if you make > something wrong you can roll back easily. > > In short - all data is there, all filenames, all file sizes. You just > need to concatenate the right clusters to get the whole file. > > If you lost whole disk (thousand of files?) and it was fragmented > already this might take weeks of work (for text files - binary files are > hardly restorable this way). Hrmm, Thought so. Yes thousands of binary files. Any text files not worth recovering. GIM is in CVS and I lose recent Sparemint work but no big deal. I guess I begin the long process of rebuilding my system from scratch. Maybe I can design in some safeguards this time ;-) Like write-protect while backing up ;-) PS: Oops, Just realized I didn't send to the list. Thanks, Mark