[Gllug] OT: Recover deleted from USB Pen drive

[Richard Jones]

On Fri, Jul 16, 2004 at 05:51:44PM +0100, James Goldwater wrote:
> Hi, not exactly a linux question but I'm in a spot of bother.  Can you 
> recover deleted files from a standard USB pen drive?  I'm using it on 
> Windows XP, but I can move to linux if needed.   I haven't put much info 
> on the drive since deleting the _incredibly important file_, so it's 
> probably still there.
> 
> Gulp.  Can anyone help?  Will Norton Utilities and the like help?  If I 
> can just do a dump of the entire thing (64Meg) I can get the file since 
> it's RTF and should be easily identifiable.

OK, first things first:

(1) DO NOT write any more stuff on it.

(2) DO take a disk image right now:

  dd if=/dev/sda1 disk.img

(/dev/sda1 might be a different device - try using 'mount')

(3) Take a back up of the disk image, and chmod it read-only.

If it's a text file, say, then you might be able to get it off just by
using an editor on the disk image.

Otherwise, it's fairly easy to recover whole files from FAT images
using a binary editor, or even emacs if you don't have a binary editor
to hand.  Just look for the last part of the file name (the first
character will have been overwritten by hex E3 IIRC), go back and
replace the first character, save, mount loopback, your file should
reappear.

Rich.

-- 
Richard Jones. http://www.annexia.org/ http://www.j-london.com/
Merjis Ltd. http://www.merjis.com/ - improving website return on investment
NET::FTPSERVER is a full-featured, secure, configurable, database-backed
FTP server written in Perl: http://www.annexia.org/freeware/netftpserver/
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug