Boston Linux & Unix (BLU) Home | Calendar | Mail Lists | List Archives | Desktop SIG | Hardware Hacking SIG
Wiki | Flickr | PicasaWeb | Video | Maps & Directions | Installfests | Keysignings
Linux Cafe | Meeting Notes | Blog | Linux Links | Bling | About BLU

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Discuss] Disk recovery utilities - dealing with deleted files



On Mon, Feb 4, 2013 at 5:29 PM, Tom Metro <tmetro+blu at gmail.com> wrote:
> Jack Coats wrote:
>> I have used SpinRite from Gibson Research...
>
> I'm pretty sure SpinRite would not be useful for this scenario. It is
> designed to deal with sectors that generate CRC errors when read, and
> uses a bunch of strategies to attempt to get a good read from a failing
> sector.
>
> In this case there are no disk errors.
>
> The only kind of tool that will help is one that is designed to sift
> through unallocated space on a drive and recognize common file
> structures (headers).
>
> A bunch of such tools are listed here:
> https://help.ubuntu.com/community/DataRecovery#Extract_individual_files_from_recovered_image
>
> I tried one of these once to search for lost Microsoft Word documents on
> someone's supposedly refortmatted drive. (Most likely using foremost,
> the first tool listed there, but I don't remember.) Either the files
> weren't there (or had been overwritten), or the tool wasn't so impressive.
>
> What I'm curious to know is where is the information stored that
> describes what sectors are chained together to form a file? If that
> information is lost (not redundantly stored in the file sectors
> themselves), you'll only be able to recover fragments, as most files on
> an actively used drive will be fragmented. (This was always a big
> limitation of the recovery tools (once you were beyond simple undeletes)
> on FAT file systems.)
>

On an NTFS filesystem, there can be multiple copies of the Master File
Table (MFT).   If a recovery tool is able to find a workable copy of
the MFT, you can be in business.

Going backwards from there, FAT12, FAT16, and FAT32, are more
primitive than NTFS, but still have workable FAT tables with which to
use.

Haven't investigated the Linux filesystem world, yet (EXTx, etc).

Scott


>  -Tom
>
> --
> Tom Metro
> Venture Logic, Newton, MA, USA
> "Enterprise solutions through open source."
> Professional Profile: http://tmetro.venturelogic.com/
> _______________________________________________
> Discuss mailing list
> Discuss at blu.org
> http://lists.blu.org/mailman/listinfo/discuss



BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org