Re: [MiNT] Bad News

[Petr Stehlik <joy@sophics.cz>]

V Čt, 26. 08. 2004 v 08:25, Mark Duckworth píše:
> I was wondering, since there was no writes other than the rm -rf /*
> (seemingly), is there any way to recover this data or is cluster sizes
> and such gone?  I tried an undelete tool and it didn't give me much to
> restore and so I didn't touch it at all.  It's a FAT partition.

on a FAT fs removing a file is a mere FAT table clearing. Also first
character of the filename is lost. That's all. Restoring deleted file(s)
consists of the following steps:

1) locate the filename in directory entries and fix the first character

2) go to the first cluster of the file and try to find the next one
(with good luck and well optimized filesystem (unfragmented) it's the
following cluster). If you find it, fix the chain in the FAT table and
continue until you restore the whole file.

Best do this on a disk image of the original disk so if you make
something wrong you can roll back easily.

In short - all data is there, all filenames, all file sizes. You just
need to concatenate the right clusters to get the whole file.

If you lost whole disk (thousand of files?) and it was fragmented
already this might take weeks of work (for text files - binary files are
hardly restorable this way).

Petr