[Gllug] OT: Recover deleted from USB Pen drive

[Russell Howe]

On Fri, Jul 16, 2004 at 06:00:31PM +0100, Bruce Richardson wrote:
> USB pen drives normally have a FAT filesystem, which would imply that
> the file may be recoverable by any tool that can undelete from DOS
> partitions.

Except some of the tools (especially DOS-based ones) won't know what a
USB device is. I'd boot into Linux (Knoppix or something if you don't
have Linux installed to HD), dd the partition off to a file, create a
working copy of the file and then point fsck.msdos or fsck.vfat to it
(whatever it's called). FAT is pretty well understood and if the file
hasn't been overwritten, it should be recoverable (compare that with
XFS, where rm means rm - even going through the filesystem with a hex
editor isn't likely to yield much)

There's also the DOS undelete command, maybe mtools has an equivalent?

-- 
Russell Howe       | Why be just another cog in the machine,
rhowe at siksai.co.uk | when you can be the spanner in the works?
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug