On Mon, 13 Dec 2004 22:08:17 +0200, Magr wrote:

How to recover OVERWRITTEN file on fat32 partition(big file - 800MB) ??? Suddenly one programm(FAME) began to do smth with my avi file, my reaction was quick but not enough as it seems> 33 kb it's new size

Could you please advice me some way to recover it. I understand that it is very harder than simply recover deleted file, because of method of deleting: When you command "delete" system just removes first and the last bits of file, and it becomes "dead-corpse"(there is no file, but filesystem knows of it and can restore it).

But it can be the same way with overwritten files: it overwrites just a part of a file(33 kb) but rest must remain the same. Didn't it ???

Can You help me with this problem ?

The first thing you want to do is preserve your filesystem. If you have enough empty space on a linux drive, then the below is the process. If you don't have enough space, then add an extra drive and use it to hold a copy of your FAT32 filesystem. Assuming you have freespace: boot from CD one of your SUSE distro's and go into rescue mode.

From there, mount the linux drive you want to write your image too. ie. mount /dev/hd?? /mnt

Then copy your fat32 filesystem to the linux drive ie. dd if=/dev/hd?? of=/mnt/image-file conv=noerror,sync I assume you know what /dev/hd?? drive/partitions to use. Once you have your filesystem preserved, you can try various recovery tools and see what they can do. If they are linux tools, you can have them access the image directly. That may involve mounting the image in loopback mode. Personnally we use FTK for Windows, but it costs a fair amount of money, and I don't know how much it would recover in this situation. Greg -- Greg Freemyer