[Discuss] FAT data recovery through Linux?

[R. Langkamer]

On 7/18/07 2:59 PM, Michael Foltinek wrote:

> I'd say it depends on what the problem actually is. There's a utility
> called testdisk that will recreate partition tables; it saved my bacon
> one time.
> If that's not your problem, then perhaps you have text files (or files
> with text in them) that you know the contents of; in that case,
> perhaps you want to dd the disk into small output files and simply
> grep for the data. If the file is fragmented, that might not be
> enough, so then I'd probably break out sleuthkit and use some of its
> tools.
> I'm not sure if it's part of the sleuthkit, but there's another
> utility called foremost (that might be the old name, or original
> version; you know how OSS can be) that might be the right tool. See
> http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm for more
> info.
> 
> I think googling "linux FAT forensic" will give you some good pointers.


	I am fairly certain it is a partition problem as it happened (a year or 
two ago - and yes the drive has been sitting around since then) when I 
was creating a new partition from free space. The FAT32 partition is 
visible in partition tables, but it will not mount. I went to 
runtime.org and downloaded get fat back (or whatever it is called) and 
it scanned the drive and it reports it is able to restore the "partition".
	I suppose now, using dd I could clone the data and then work on that 
copy (as someone has recommended and that is very good idea).

	That is an excellent GooFu suggestion. Thank you. I will have a look 
see at what the "tubes" can feed me.

-- 

Sincerely,

R. Langkamer

cross platform specialist
Mac - Linux - windows

Langkamer I.T.
on-site/remote tutorials, support & training
(T) 250.391.8972
(F) 250.391.8972
(E) ruairi @ langkamerit . com