[Discuss] Disk recovery utilities - dealing with deleted files

[srehrlich at gmail.com (Scott Ehrlich)]

On Mon, Feb 4, 2013 at 5:29 PM, Tom Metro <tmetro+blu at gmail.com> wrote:
> Jack Coats wrote:
>> I have used SpinRite from Gibson Research...
>
> I'm pretty sure SpinRite would not be useful for this scenario. It is
> designed to deal with sectors that generate CRC errors when read, and
> uses a bunch of strategies to attempt to get a good read from a failing
> sector.
>
> In this case there are no disk errors.
>
> The only kind of tool that will help is one that is designed to sift
> through unallocated space on a drive and recognize common file
> structures (headers).
>
> A bunch of such tools are listed here:
> https://help.ubuntu.com/community/DataRecovery#Extract_individual_files_from_recovered_image
>
> I tried one of these once to search for lost Microsoft Word documents on
> someone's supposedly refortmatted drive. (Most likely using foremost,
> the first tool listed there, but I don't remember.) Either the files
> weren't there (or had been overwritten), or the tool wasn't so impressive.
>
> What I'm curious to know is where is the information stored that
> describes what sectors are chained together to form a file? If that
> information is lost (not redundantly stored in the file sectors
> themselves), you'll only be able to recover fragments, as most files on
> an actively used drive will be fragmented. (This was always a big
> limitation of the recovery tools (once you were beyond simple undeletes)
> on FAT file systems.)
>

On an NTFS filesystem, there can be multiple copies of the Master File
Table (MFT).   If a recovery tool is able to find a workable copy of
the MFT, you can be in business.

Going backwards from there, FAT12, FAT16, and FAT32, are more
primitive than NTFS, but still have workable FAT tables with which to
use.

Haven't investigated the Linux filesystem world, yet (EXTx, etc).

Scott


>  -Tom
>
> --
> Tom Metro
> Venture Logic, Newton, MA, USA
> "Enterprise solutions through open source."
> Professional Profile: http://tmetro.venturelogic.com/
> _______________________________________________
> Discuss mailing list
> Discuss at blu.org
> http://lists.blu.org/mailman/listinfo/discuss