-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Thursday 2006-06-01 at 11:03 -0400, Jerry Feldman wrote:
It sounds like a pretty decent program. Most recovery programs for FAT file systems don't try to actually recover the data, they simply update the directory and possibly make some changes in the File Access Table (FAT).
No, that's not exactly so. They update the directory entry by replacing the first letter of the name (which was changed to a special letter used as flag for "deleted", which I don't remember offhand which it was), _and_ updates the FAT - always. The directory table contains a pointer to the first data block (first fat entry of the file), and also contains the file size. Based on that size it calculates the number of blocks, and from that it tries to guess the following data blocks of the file till completing the required number for the known size. Therefore, only the first block of the file can be guaranteed to be correct (if it has not been reused), and all the rest are guessed; thus small files (less than 1 block) are safely recovered. For longer files, if the filesysten was not fragmented, recovery chances are very good. And, if the undeleting program can do a consistency analysis of the data (as PhotoRec is reported to do), chances are better. I remember of some programs that allowed to manually choose which blocks to add to the file chain. It was pretty good for text files that we cold recognize on sight. Some MsDos utilities kept a snapshot of directory entries and fat, made at shutdown or boot, to help recover files later. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEfzbytTMYHG2NR9URAhgRAKCXV17TB+f6jtV/VQFELcmehM/8zwCfWM6d k2gE5LUlUBWbD7oy5avEnWs= =/EGA -----END PGP SIGNATURE----- -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help@suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq@suse.com