[Discuss] FAT data recovery through Linux?

[Michael Foltinek]

I suggest that if you're going to take a dd image of the drive, then
work on the drive and leave the copy alone; you can always dd the
image back onto the device. It can be a PITA to work with a disk image
as if it's a true device.

Try testdisk first on the device to see if it can figure out where the
partitions were. You'll have the option of backing out if they don't
look right.

Since you have a FAT fs, you're in really good shape; it's a
well-understood filesystem and a fairly simple one at that, so there
should be no gotchas in getting your data back.

On 7/18/07, R. Langkamer <techie at mcfarlanecomputing.net> wrote:
> On 7/18/07 2:59 PM, Michael Foltinek wrote:
>
> > I'd say it depends on what the problem actually is. There's a utility
> > called testdisk that will recreate partition tables; it saved my bacon
> > one time.
> > If that's not your problem, then perhaps you have text files (or files
> > with text in them) that you know the contents of; in that case,
> > perhaps you want to dd the disk into small output files and simply
> > grep for the data. If the file is fragmented, that might not be
> > enough, so then I'd probably break out sleuthkit and use some of its
> > tools.
> > I'm not sure if it's part of the sleuthkit, but there's another
> > utility called foremost (that might be the old name, or original
> > version; you know how OSS can be) that might be the right tool. See
> > http://www.samag.com/documents/s=8859/sam0309a/sam0309a.htm for more
> > info.
> >
> > I think googling "linux FAT forensic" will give you some good pointers.
>
>
>         I am fairly certain it is a partition problem as it happened (a year or
> two ago - and yes the drive has been sitting around since then) when I
> was creating a new partition from free space. The FAT32 partition is
> visible in partition tables, but it will not mount. I went to
> runtime.org and downloaded get fat back (or whatever it is called) and
> it scanned the drive and it reports it is able to restore the "partition".
>         I suppose now, using dd I could clone the data and then work on that
> copy (as someone has recommended and that is very good idea).
>
>         That is an excellent GooFu suggestion. Thank you. I will have a look
> see at what the "tubes" can feed me.
>
> --
>
> Sincerely,
>
> R. Langkamer
>
> cross platform specialist
> Mac - Linux - windows
>
> Langkamer I.T.
> on-site/remote tutorials, support & training
> (T) 250.391.8972
> (F) 250.391.8972
> (E) ruairi @ langkamerit . com
> _______________________________________________
> Discuss mailing list
> Discuss at vlug.org
> http://ladybug.vlug.org/cgi-bin/mailman/listinfo/discuss
>


-- 
True compassion is more than flinging a coin at a beggar; it comes to
see that an edifice which produces beggars needs restructuring.
	- Dr. Martin Luther King Jr.