[ale] Any FAT recovery tools?

[John Mills]

Mike -

Thanks for several good ideas. With only a few files to recapture and 
knowing their original names, fsck.vfat looks like a clean tool to try.

Otherwise I guess I may edit the directory and/or FAT records.

My _second_ thought &8-) when I realized I was erasing pictures I hadn't 
seen on the backup CD was, "Well a lot of folks must do this -- let's hit 
the web for tools." Indeed a wide selection exists. Most seem unduly 
expen$ive. One that even proposed the correct file names to restore was 
$69.00. (The "demo" only _named_ the files; it wouldn't actually recover 
them. Talk about "bait and switch"!)

The free 'ZAR' ("Zero-Assumption Recovery") utility got results I 
can live with, but I still want to learn something out of this. After all 
it can't be anything like the 'death march' I went through to recover 
parts of an EXT3 directory!

Cheers.

 - John

On Sat, 19 Jan 2008, Michael B. Trausch wrote:

> On Sat, 2008-01-19 at 15:09 -0500, John Mills wrote:
> > I would like to recover some files deleted in a FAT32 filesystem (SD
> > card, actually). Nothing was done to the card since about 10 files
> > were unwisely deleted while the card was installed in a camera, and
> > I'm carefully avoiding any write activity until this is resolved..

> Ahh, to dig around in my memory.  As I recall, when a file is removed on
> a filesystem in the FAT family, what really happens is that the clusters
> are marked as free and the directory entry is altered with the first
> character of the directory entry becoming something special.  A quick
> look on Wikipedia[1] shows that the first byte of a file name in a
> directory entry can have one of four special values:
> 
>   * 0x00 - Available entry, and no subsequent entry is in use
>   * 0x05 - First character is actually 0xE5
>   * 0x2E - A dot entry (either '.' or '..')
>   * 0x5E - Entry has been previously erased.  This is the one you want.
> 
> Oh.  Wait.  After reading that I did another search which seems to have
> turned up some interesting information:  apparently, fsck.vfat has an
> "undelete" feature.[2]  Looking at the fsck.vfat man page, it seems that
> you can specify one file at a time.  You could easily use a shell script
> to work around all of that by taking, as you have suggested, a
> bit-for-bit copy of the drive and working with it through a loopback
> device.  Perhaps I will actually test something like that soon, because
> that looks to be very interesting.  I know people that use SD cards that
> accidentally delete data all the time.  Maybe even better, an
> "undelete.vfat" utility might be of use that would look through the
> filesystem and prompt for recovery of previously deleted files, though
> that would probably be less than trivial to write.