Hi, I accidentally erased my flash card with tons of photos. As it is mount as fat32, I was wondering if there is a undelete tool. My findings so far are: 1. fsck.vfat -u - but this undeletes one file at a time, and I need to know the filenames 2. A product named PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec), but I could not find 64-bit RPM I use 10.0 64bit). I may compile it, but ... ;) So, any other option, possibly included with SuSE? -- -- Svetoslav Milenov (Sunny) Windows is a 32-bit extension to a 16-bit graphical shell for an 8-bit operating system originally coded for a 4-bit microprocessor by a 2-bit company that can't stand 1 bit of competition. -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
At 07:39 PM 5/31/2006 -0500, Sunny wrote:
Content-Disposition: inline
Hi, I accidentally erased my flash card with tons of photos. As it is mount as fat32, I was wondering if there is a undelete tool.
My findings so far are:
1. fsck.vfat -u - but this undeletes one file at a time, and I need to know the filenames 2. A product named PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec), but I could not find 64-bit RPM I use 10.0 64bit). I may compile it, but ... ;)
So, any other option, possibly included with SuSE?
Google has a slew of these undelete tools listed. Of course, they run on Windows--that's what runs FAT, anyway, most times. I would NOT run one that runs on DOS, since all the long filenames would be truncated. You could probably scrounge up a free copy of Win 98 from somebody to run one of them. (If you happen to live on Long Island, NY, I should be able to come up with it. Just give me a day or so to find it.) --dm -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.1.394 / Virus Database: 268.8.0/353 - Release Date: 5/31/2006 -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On Wednesday 31 May 2006 20:39, Sunny wrote:
I accidentally erased my flash card with tons of photos. As it is mount as fat32, I was wondering if there is a undelete tool.
My findings so far are:
1. fsck.vfat -u - but this undeletes one file at a time, and I need to know the filenames 2. A product named PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec), but I could not find 64-bit RPM I use 10.0 64bit). I may compile it, but ... ;)
So, any other option, possibly included with SuSE?
Hi Sunny, Just out of curiosity, how many photos are you talking about? I mean, a "ton" of megabytes is an awful lot of electrons! ;-) From my archives: http://www.porcupine.org/forensics/tct.html (be sure to check the link at the very bottom of the page!) Another idea... I wonder if DOS 6.22 'undelete.exe' will run under dosbox (included with SUSE)? I found a page where you can download it... :-) http://www.uv.tietgen.dk/staff/mlha/Download/DOS/ You can make an image of the flash card with dd as a backup, right? Then try running 'undelete.exe' under dosbox. I have no idea if this will work or not, but it'd probably be fun trying. regards, Carl -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On 5/31/06, Carl Hartung wrote:
On Wednesday 31 May 2006 20:39, Sunny wrote:
I accidentally erased my flash card with tons of photos. As it is mount as fat32, I was wondering if there is a undelete tool.
My findings so far are:
1. fsck.vfat -u - but this undeletes one file at a time, and I need to know the filenames 2. A product named PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec), but I could not find 64-bit RPM I use 10.0 64bit). I may compile it, but ... ;)
So, any other option, possibly included with SuSE?
Hi Sunny,
Just out of curiosity, how many photos are you talking about? I mean, a "ton" of megabytes is an awful lot of electrons! ;-)
512MB - like 250 pictures :( The problem was with digiCam actually. Because of not enough free space it silently stopped the copy process. No warning, nothing. I was under the impression that it have downloaded all pictures from the card, and I ran Delete All :(
From my archives:
http://www.porcupine.org/forensics/tct.html (be sure to check the link at the very bottom of the page!)
Looks complicated ... but maybe I'll try this as last resort
Another idea... I wonder if DOS 6.22 'undelete.exe' will run under dosbox (included with SUSE)? I found a page where you can download it... :-)
I'll try this first
You can make an image of the flash card with dd as a backup, right? Then try running 'undelete.exe' under dosbox. I have no idea if this will work or not, but it'd probably be fun trying.
Yes, I already did dd, this is usually the first thing I always do when something goes south :)
regards,
Carl
Maybe I'll try to build a list of the files - they all are dscxxxxx.jpg, and usually only the first letter is lost. So if I put all names in a file, I can try using fsck.vfat -u for every file from a script (not that I understand how :) but I'm sure that I can find out how to run a command over every line of a file). Thanks for the suggestions though. -- Svetoslav Milenov (Sunny) Windows is a 32-bit extension to a 16-bit graphical shell for an 8-bit operating system originally coded for a 4-bit microprocessor by a 2-bit company that can't stand 1 bit of competition. -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On 5/31/06, Sunny
On 5/31/06, Carl Hartung wrote:
On Wednesday 31 May 2006 20:39, Sunny wrote:
I accidentally erased my flash card with tons of photos. As it is mount as fat32, I was wondering if there is a undelete tool.
My findings so far are:
1. fsck.vfat -u - but this undeletes one file at a time, and I need to know the filenames 2. A product named PhotoRec (http://www.cgsecurity.org/wiki/PhotoRec), but I could not find 64-bit RPM I use 10.0 64bit). I may compile it, but ... ;)
OK, the problem is solved. This program (PhotoRec) http://www.cgsecurity.org/wiki/PhotoRec is real life saver. The guys provide 32 bit RPM, which worked smoothly on my 64bit 10.0. It even worked on the dd image I created from the already deleted flash card. Amazing :) It recovered all my lost pictures, as well as some older ones, deleted in a previous sessions :) I'll post a feature request at opensuse for this program - looks like very useful tool :) -- Svetoslav Milenov (Sunny) Windows is a 32-bit extension to a 16-bit graphical shell for an 8-bit operating system originally coded for a 4-bit microprocessor by a 2-bit company that can't stand 1 bit of competition. -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On 6/1/06, Sunny wrote:
I'll post a feature request at opensuse for this program - looks like very useful tool :)
posted here: http://en.opensuse.org/Wishlist_Various -- -- Svetoslav Milenov (Sunny) Windows is a 32-bit extension to a 16-bit graphical shell for an 8-bit operating system originally coded for a 4-bit microprocessor by a 2-bit company that can't stand 1 bit of competition. -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On Thursday 01 June 2006 1:16 am, Sunny wrote:
OK, the problem is solved. This program (PhotoRec) http://www.cgsecurity.org/wiki/PhotoRec is real life saver. The guys provide 32 bit RPM, which worked smoothly on my 64bit 10.0. It even worked on the dd image I created from the already deleted flash card. Amazing :) Good. Actually, when a file is "deleted" in a FAT file system, only the first byte of the directory entry is changed to zero. This goes back to when the PC was floppy based. it makes a delete operation fast, and it also has the side effect of allowing easy undeletes. -- Jerry Feldman
Boston Linux and Unix user group http://www.blu.org PGP key id:C5061EA9 PGP Key fingerprint:053C 73EC 3AC1 5C44 3E14 9245 FB00 3ED5 C506 1EA9
-- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
On 6/1/06, Jerry Feldman wrote:
On Thursday 01 June 2006 1:16 am, Sunny wrote:
OK, the problem is solved. This program (PhotoRec) http://www.cgsecurity.org/wiki/PhotoRec is real life saver. The guys provide 32 bit RPM, which worked smoothly on my 64bit 10.0. It even worked on the dd image I created from the already deleted flash card. Amazing :) Good. Actually, when a file is "deleted" in a FAT file system, only the first byte of the directory entry is changed to zero. This goes back to when the PC was floppy based. it makes a delete operation fast, and it also has the side effect of allowing easy undeletes.
Actually, PhotoRec does not "try" to restore the file system - it works on mutiple filesystems (incl. a dd image :) ), and tries to determine a sequence of sectors (or inodes, or whatever) as a jpg or wmv files. For my situation it worked perfectly, but maybe on a fragmented FS it would not be so good, I have no way to know. -- -- Svetoslav Milenov (Sunny) Windows is a 32-bit extension to a 16-bit graphical shell for an 8-bit operating system originally coded for a 4-bit microprocessor by a 2-bit company that can't stand 1 bit of competition. -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
Actually, PhotoRec does not "try" to restore the file system - it works on mutiple filesystems (incl. a dd image :) ), and tries to determine a sequence of sectors (or inodes, or whatever) as a jpg or wmv files. For my situation it worked perfectly, but maybe on a fragmented FS it would not be so good, I have no way to know. It sounds like a pretty decent program. Most recovery programs for FAT file systems don't try to actually recover the data, they simply update the
On Thursday 01 June 2006 9:59 am, Sunny wrote:
directory and possibly make some changes in the File Access Table (FAT).
--
Jerry Feldman
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2006-06-01 at 11:03 -0400, Jerry Feldman wrote:
It sounds like a pretty decent program. Most recovery programs for FAT file systems don't try to actually recover the data, they simply update the directory and possibly make some changes in the File Access Table (FAT).
No, that's not exactly so. They update the directory entry by replacing the first letter of the name (which was changed to a special letter used as flag for "deleted", which I don't remember offhand which it was), _and_ updates the FAT - always. The directory table contains a pointer to the first data block (first fat entry of the file), and also contains the file size. Based on that size it calculates the number of blocks, and from that it tries to guess the following data blocks of the file till completing the required number for the known size. Therefore, only the first block of the file can be guaranteed to be correct (if it has not been reused), and all the rest are guessed; thus small files (less than 1 block) are safely recovered. For longer files, if the filesysten was not fragmented, recovery chances are very good. And, if the undeleting program can do a consistency analysis of the data (as PhotoRec is reported to do), chances are better. I remember of some programs that allowed to manually choose which blocks to add to the file chain. It was pretty good for text files that we cold recognize on sight. Some MsDos utilities kept a snapshot of directory entries and fat, made at shutdown or boot, to help recover files later. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEfzbytTMYHG2NR9URAhgRAKCXV17TB+f6jtV/VQFELcmehM/8zwCfWM6d k2gE5LUlUBWbD7oy5avEnWs= =/EGA -----END PGP SIGNATURE----- -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com
participants (5)
-
Carl Hartung
-
Carlos E. R.
-
Doug McGarrett
-
Jerry Feldman
-
Sunny