[ale] semi [OT] help recovering data from memory card

David Tomaschik david at systemoverlord.com
Thu Oct 20 11:52:41 EDT 2011


> I see. My bad. I assumed PhotoRec would use the file system structures
> on the device to navigate.  Since it seemed to work for you I started to
> wonder, where did the file system come from? And then the thought
> occurred to me that perhaps Windows saw that the file contained a FAT
> file system and automatically installed it as such on the mem stick --
> which could, of course, be disastrous if that's not what you intended.
> But it does sound like the kind of "helpful" thing Windows is known for.
> In retrospect, I guess it was silly thinking on my part.
>
> So perhaps the data blocks in the file aligned just enough that PhotoRec
> was able to treat it as part of the actual file system?  Maybe it uses a
> file system where it can and just "bush whacks" it the rest of the way.
> That could explain why it was able to recover some of your deleted files
> as well.
>
> Anyway, glad you were able to help your relative.

if I understand it correctly, some of the techniques used by Photorec
are independent of the filesystem.  I believe they look at each block
for signatures of particular file types (similar to how the unix
command "file" works) and then try to reconstruct the file from there.
 In my experience, it's not very good with fragmented files, which
lends credit to the block-by-block approach.



-- 
David Tomaschik, RHCE, LPIC-1
System Administrator/Open Source Advocate
OpenPGP: 0x5DEA789B
http://systemoverlord.com
david at systemoverlord.com



More information about the Ale mailing list