[ale] Any FAT recovery tools?

[Michael B. Trausch]

On Sat, 2008-01-19 at 15:09 -0500, John Mills wrote:
> I would like to recover some files deleted in a FAT32 filesystem (SD
> card, actually). Nothing was done to the card since about 10 files
> were unwisely deleted while the card was installed in a camera, and
> I'm carefully avoiding any write activity until this is resolved..
> 
> I've used some of the free MsWin recovery tools, but there seem to be
> subtleties in Canon's storage or with *.jpg handling - these are image
> files and seem to have lost some quality in the process. (I don't
> really know how that would happen and still give a readable JPEG, but
> there are visible differences when original and recovered images are
> displayed side by side.)
> 
> I wondered if anyone could suggest a Linux tool for this type
> 'unerase'? I was planning to capture the card image with 'dd',
> loopback-mount the image file, and work on that. I suppose this could
> even be scripted somewhere.

Ahh, to dig around in my memory.  As I recall, when a file is removed on
a filesystem in the FAT family, what really happens is that the clusters
are marked as free and the directory entry is altered with the first
character of the directory entry becoming something special.  A quick
look on Wikipedia[1] shows that the first byte of a file name in a
directory entry can have one of four special values:

  * 0x00 - Available entry, and no subsequent entry is in use
  * 0x05 - First character is actually 0xE5
  * 0x2E - A dot entry (either '.' or '..')
  * 0x5E - Entry has been previously erased.  This is the one you want.

Oh.  Wait.  After reading that I did another search which seems to have
turned up some interesting information:  apparently, fsck.vfat has an
"undelete" feature.[2]  Looking at the fsck.vfat man page, it seems that
you can specify one file at a time.  You could easily use a shell script
to work around all of that by taking, as you have suggested, a
bit-for-bit copy of the drive and working with it through a loopback
device.  Perhaps I will actually test something like that soon, because
that looks to be very interesting.  I know people that use SD cards that
accidentally delete data all the time.  Maybe even better, an
"undelete.vfat" utility might be of use that would look through the
filesystem and prompt for recovery of previously deleted files, though
that would probably be less than trivial to write.

	--- Mike

[1] http://en.wikipedia.org/wiki/File_Allocation_Table
[2] http://lists.slug.org.au/archives/slug/2006/05/msg00002.html

-- 
Michael B. Trausch                                   mike at trausch.us
home: 404-592-5746, 1                                 www.trausch.us
cell: 678-522-7934                       im: mike at trausch.us, jabber
Ubuntu Unofficial Backports Project:    http://backports.trausch.us/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part