[Gllug] OT: Recover deleted from USB Pen drive - THANKS!

[James Goldwater]

Ok, I booted into knoppix and dd'd the drive over to a file, and moved 
it over to my server.  Using Debian Woody and the dosfsutils package I 
tried

fsck.vfat -u thefile.rtf pendrive-dump.bin

but that didn't undelete it.

Looking at it in a hexeditor (hexedit) I could see the filename in the 
FAT, but partially overwritten, so I think that's why it couldn't 
undelete it.  Anyway, I found where the file was in the dump using 
hexedit (lots of scrolling! - but I'd confirmed it was there using 
strings and grep), found where it began, and used

dd -bs=256 skip=4322 count=1000 if=pendrive-dump.bin of=thefile.rtf

and by varying count, I managed to get it back, minus a very small bit 
at the end which didn't seem to be contiguous, but didn't matter anyway.

Is there a tool/library/whatever which can parse FAT tables of various 
filesystems and present them in a meaningful way?  I'm not sure why 
fsck.vfat couldn't undelete it.  As I said, the filename looked 
partially overwritten, but I'm just guessing cos I don't know the layout 
of the table.

Craig Millar wrote:

> James Goldwater wrote:
> 
>> Thanks very much everybody for the advice!  And also, thank you 
>> Knoppix (-: Job done, phew!
>>
>> James
>>
> Care to tell us exactly which advice you took and what you did to 
> achieve this, just so we know? Thanks, Craig


-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug