[ale] Any FAT recovery tools?

[David Tomaschik]

Take a look at photorec.

David


John Mills wrote:
> Mike -
>
> Thanks for several good ideas. With only a few files to recapture and 
> knowing their original names, fsck.vfat looks like a clean tool to try.
>
> Otherwise I guess I may edit the directory and/or FAT records.
>
> My _second_ thought &8-) when I realized I was erasing pictures I hadn't 
> seen on the backup CD was, "Well a lot of folks must do this -- let's hit 
> the web for tools." Indeed a wide selection exists. Most seem unduly 
> expen$ive. One that even proposed the correct file names to restore was 
> $69.00. (The "demo" only _named_ the files; it wouldn't actually recover 
> them. Talk about "bait and switch"!)
>
> The free 'ZAR' ("Zero-Assumption Recovery") utility got results I 
> can live with, but I still want to learn something out of this. After all 
> it can't be anything like the 'death march' I went through to recover 
> parts of an EXT3 directory!
>
> Cheers.
>
>  - John
>
> On Sat, 19 Jan 2008, Michael B. Trausch wrote:
>
>   
>> On Sat, 2008-01-19 at 15:09 -0500, John Mills wrote:
>>     
>>> I would like to recover some files deleted in a FAT32 filesystem (SD
>>> card, actually). Nothing was done to the card since about 10 files
>>> were unwisely deleted while the card was installed in a camera, and
>>> I'm carefully avoiding any write activity until this is resolved..
>>>       
>
>   
>> Ahh, to dig around in my memory.  As I recall, when a file is removed on
>> a filesystem in the FAT family, what really happens is that the clusters
>> are marked as free and the directory entry is altered with the first
>> character of the directory entry becoming something special.  A quick
>> look on Wikipedia[1] shows that the first byte of a file name in a
>> directory entry can have one of four special values:
>>
>>   * 0x00 - Available entry, and no subsequent entry is in use
>>   * 0x05 - First character is actually 0xE5
>>   * 0x2E - A dot entry (either '.' or '..')
>>   * 0x5E - Entry has been previously erased.  This is the one you want.
>>
>> Oh.  Wait.  After reading that I did another search which seems to have
>> turned up some interesting information:  apparently, fsck.vfat has an
>> "undelete" feature.[2]  Looking at the fsck.vfat man page, it seems that
>> you can specify one file at a time.  You could easily use a shell script
>> to work around all of that by taking, as you have suggested, a
>> bit-for-bit copy of the drive and working with it through a loopback
>> device.  Perhaps I will actually test something like that soon, because
>> that looks to be very interesting.  I know people that use SD cards that
>> accidentally delete data all the time.  Maybe even better, an
>> "undelete.vfat" utility might be of use that would look through the
>> filesystem and prompt for recovery of previously deleted files, though
>> that would probably be less than trivial to write.
>>     
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://www.ale.org/mailman/listinfo/ale
>   


-- 
David Tomaschik
Moderator, LinuxQuestions.org
http://matir.wordpress.com