[Discuss] Disk recovery utilities - dealing with deleted files

[tmetro+blu at gmail.com (Tom Metro)]

Jack Coats wrote:
> I have used SpinRite from Gibson Research...

I'm pretty sure SpinRite would not be useful for this scenario. It is
designed to deal with sectors that generate CRC errors when read, and
uses a bunch of strategies to attempt to get a good read from a failing
sector.

In this case there are no disk errors.

The only kind of tool that will help is one that is designed to sift
through unallocated space on a drive and recognize common file
structures (headers).

A bunch of such tools are listed here:
https://help.ubuntu.com/community/DataRecovery#Extract_individual_files_from_recovered_image

I tried one of these once to search for lost Microsoft Word documents on
someone's supposedly refortmatted drive. (Most likely using foremost,
the first tool listed there, but I don't remember.) Either the files
weren't there (or had been overwritten), or the tool wasn't so impressive.

What I'm curious to know is where is the information stored that
describes what sectors are chained together to form a file? If that
information is lost (not redundantly stored in the file sectors
themselves), you'll only be able to recover fragments, as most files on
an actively used drive will be fragmented. (This was always a big
limitation of the recovery tools (once you were beyond simple undeletes)
on FAT file systems.)

 -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/