Mailinglist Archive: opensuse (3605 mails)
| < Previous | Next > |
Re: [SLE] FAT32 undelete
- From: "Carlos E. R." <robin.listas@xxxxxxxxxxxxxx>
- Date: Thu, 1 Jun 2006 20:50:23 +0200 (CEST)
- Message-id: <Pine.LNX.4.61.0606012035060.24267@xxxxxxxxxxxxxxxx>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The Thursday 2006-06-01 at 11:03 -0400, Jerry Feldman wrote:
> It sounds like a pretty decent program. Most recovery programs for FAT file
> systems don't try to actually recover the data, they simply update the
> directory and possibly make some changes in the File Access Table (FAT).
No, that's not exactly so. They update the directory entry by replacing
the first letter of the name (which was changed to a special letter used
as flag for "deleted", which I don't remember offhand which it was), _and_
updates the FAT - always.
The directory table contains a pointer to the first data block (first fat
entry of the file), and also contains the file size. Based on that size it
calculates the number of blocks, and from that it tries to guess the
following data blocks of the file till completing the required number for
the known size.
Therefore, only the first block of the file can be guaranteed to be
correct (if it has not been reused), and all the rest are guessed; thus
small files (less than 1 block) are safely recovered. For longer files, if
the filesysten was not fragmented, recovery chances are very good. And, if
the undeleting program can do a consistency analysis of the data (as
PhotoRec is reported to do), chances are better.
I remember of some programs that allowed to manually choose which blocks
to add to the file chain. It was pretty good for text files that we cold
recognize on sight.
Some MsDos utilities kept a snapshot of directory entries and fat, made at
shutdown or boot, to help recover files later.
- --
Cheers,
Carlos Robinson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Made with pgp4pine 1.76
iD8DBQFEfzbytTMYHG2NR9URAhgRAKCXV17TB+f6jtV/VQFELcmehM/8zwCfWM6d
k2gE5LUlUBWbD7oy5avEnWs=
=/EGA
-----END PGP SIGNATURE-----
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-help@xxxxxxxx
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-faq@xxxxxxxx
Hash: SHA1
The Thursday 2006-06-01 at 11:03 -0400, Jerry Feldman wrote:
> It sounds like a pretty decent program. Most recovery programs for FAT file
> systems don't try to actually recover the data, they simply update the
> directory and possibly make some changes in the File Access Table (FAT).
No, that's not exactly so. They update the directory entry by replacing
the first letter of the name (which was changed to a special letter used
as flag for "deleted", which I don't remember offhand which it was), _and_
updates the FAT - always.
The directory table contains a pointer to the first data block (first fat
entry of the file), and also contains the file size. Based on that size it
calculates the number of blocks, and from that it tries to guess the
following data blocks of the file till completing the required number for
the known size.
Therefore, only the first block of the file can be guaranteed to be
correct (if it has not been reused), and all the rest are guessed; thus
small files (less than 1 block) are safely recovered. For longer files, if
the filesysten was not fragmented, recovery chances are very good. And, if
the undeleting program can do a consistency analysis of the data (as
PhotoRec is reported to do), chances are better.
I remember of some programs that allowed to manually choose which blocks
to add to the file chain. It was pretty good for text files that we cold
recognize on sight.
Some MsDos utilities kept a snapshot of directory entries and fat, made at
shutdown or boot, to help recover files later.
- --
Cheers,
Carlos Robinson
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Made with pgp4pine 1.76
iD8DBQFEfzbytTMYHG2NR9URAhgRAKCXV17TB+f6jtV/VQFELcmehM/8zwCfWM6d
k2gE5LUlUBWbD7oy5avEnWs=
=/EGA
-----END PGP SIGNATURE-----
--
Check the headers for your unsubscription address
For additional commands send e-mail to suse-linux-e-help@xxxxxxxx
Also check the archives at http://lists.suse.com
Please read the FAQs: suse-linux-e-faq@xxxxxxxx
| < Previous | Next > |