[Discuss] Disk recovery utilities - dealing with deleted files

[jprigot at verizon.net (Jonathan M. Prigot)]

Since you're looking to get stuff back, post-deletion, how about
"photorec"? We've used it here and its main drawback is that it attempts
to make sense of nonsense as well as making sense of sense. 
-- 
Jonathan M. Prigot <jprigot at verizon.net>

On Mon, 2013-02-04 at 17:29 -0500, Tom Metro wrote:
> Jack Coats wrote:
> > I have used SpinRite from Gibson Research...
> 
> I'm pretty sure SpinRite would not be useful for this scenario. It is
> designed to deal with sectors that generate CRC errors when read, and
> uses a bunch of strategies to attempt to get a good read from a failing
> sector.
> 
> In this case there are no disk errors.
> 
> The only kind of tool that will help is one that is designed to sift
> through unallocated space on a drive and recognize common file
> structures (headers).
> 
> A bunch of such tools are listed here:
> https://help.ubuntu.com/community/DataRecovery#Extract_individual_files_from_recovered_image
> 
> I tried one of these once to search for lost Microsoft Word documents on
> someone's supposedly refortmatted drive. (Most likely using foremost,
> the first tool listed there, but I don't remember.) Either the files
> weren't there (or had been overwritten), or the tool wasn't so impressive.
> 
> What I'm curious to know is where is the information stored that
> describes what sectors are chained together to form a file? If that
> information is lost (not redundantly stored in the file sectors
> themselves), you'll only be able to recover fragments, as most files on
> an actively used drive will be fragmented. (This was always a big
> limitation of the recovery tools (once you were beyond simple undeletes)
> on FAT file systems.)
> 
>  -Tom
> 



The information in this e-mail is intended only for the person to whom it is
addressed. If you believe this e-mail was sent to you in error and the e-mail
contains patient information, please contact the Partners Compliance HelpLine at
http://www.partners.org/complianceline . If the e-mail was sent to you in error
but does not contain patient information, please contact the sender and properly
dispose of the e-mail.