Re: [MiNT] Bad News

[Mark Duckworth <mduckworth@atari-source.com>]

On Thu, 2004-08-26 at 02:51, Petr Stehlik wrote:
> V Čt, 26. 08. 2004 v 08:25, Mark Duckworth píše:
> > I was wondering, since there was no writes other than the rm -rf /*
> > (seemingly), is there any way to recover this data or is cluster sizes
> > and such gone?  I tried an undelete tool and it didn't give me much to
> > restore and so I didn't touch it at all.  It's a FAT partition.
> 
> on a FAT fs removing a file is a mere FAT table clearing. Also first
> character of the filename is lost. That's all. Restoring deleted file(s)
> consists of the following steps:
> 
> 1) locate the filename in directory entries and fix the first character
> 
> 2) go to the first cluster of the file and try to find the next one
> (with good luck and well optimized filesystem (unfragmented) it's the
> following cluster). If you find it, fix the chain in the FAT table and
> continue until you restore the whole file.
> 
> Best do this on a disk image of the original disk so if you make
> something wrong you can roll back easily.
> 
> In short - all data is there, all filenames, all file sizes. You just
> need to concatenate the right clusters to get the whole file.
> 
> If you lost whole disk (thousand of files?) and it was fragmented
> already this might take weeks of work (for text files - binary files are
> hardly restorable this way).

Hrmm,

Thought so.  Yes thousands of binary files.  Any text files not worth
recovering.  GIM is in CVS and I lose recent Sparemint work but no big
deal.  I guess I begin the long process of rebuilding my system from
scratch.  Maybe I can design in some safeguards this time ;-)  Like
write-protect while backing up ;-)

PS: Oops, Just realized I didn't send to the list.

Thanks,
Mark