(OT) SmartMedia un-erasing - help?

Just a note to add to this thread, for when someone Googles it in the future: from what I've seen, Mac OS X writes some small files to any volume that's attached. That's usually not a big deal, but in a situation where you're trying to recover from a format, it's a very big deal, as it means that blocks may be reused. I'm not sure if the Mac's automount behavior can be turned off, but on many *nix boxes mounting is an intentional choice (and I've not seen *nix gratuitously scribble on a newly mounted volume, either). That also allows you to mount it read-only. -- Ian ________________________________________ From: cctalk-bounces at classiccmp.org [cctalk-bounces at classiccmp.org] On Behalf Of Mark Tapley [mtapley at swri.edu] Sent: Friday, November 18, 2011 8:45 AM To: cctalk at classiccmp.org Subject: Re: (OT) SmartMedia un-erasing - help? Joe P., thanks for the pointer to digital image recovery! I'll find a Windows machine and try it if I can't work the problem with my Mac. ----- John F, DigitalForensics will also get a shot when/if I start seeing bits of files recovered. That's not looking so likely, though. ----- At 19:31 -0600 11/17/11, Ian wrote: You have my sympathy and thanks! What was on my card would have been all .jpg compressed images, so Photorec looks perfect. ------ At 19:31 -0600 11/17/11, Ian and Mouse pretty much chorused: Ah! mtapley-3:~ mtapley$ mount ... /dev/disk1s1 on /Volumes/Untitled (local, nodev, nosuid) mtapley-3:~ mtapley$ su root ... mtapley-3:/Users/mtapley root# umount /dev/disk1s1 mtapley-3:/Users/mtapley root# dd if=/dev/disk1s1 of=PhotosToSort/LostCard/ddClone128M.dd conv=noerror,sync 255953+0 records in 255953+0 records out 131047936 bytes transferred in 153.810460 secs (852009 bytes/sec) The naive shortcut to /Volumes just got me a symlink or something? I'm embarrassed to admit I had to hit more man pages to remember that unmount is spelled umount. Anyway the dd command chugged for several minutes.... ...at the end of which, I got another image which was composed almost entirely of "FF" pairs, according to OxED. Near the start, there is, as in the other images, "FAT16", some stuff that says "DCIM" and "Trashes", "100OLYMP", a "Mac OS X" string, a "This resource fork intentionally left blank " string, and a few other short (10's of bytes) bits of stuff in mostly 00 areas. After that, just an ocean of FF pairs. Not surprisingly, Photorec finds nothing. Likewise for Exif-U. 0 files saved in /Users/mtapley/Applications/testdisk-6.13/recup_dir directory. Recovery completed. Although I'm willing to go on and try other tools if people want, I've become a tad discouraged at this point. Am I right to be so? It looks to me like the camera re-initialized the card and wrote all FF, ready to be recorded on, and if Mouse is correct that's pretty much that. Even for the cool Yellowstone photos, I'm not willing to pay for an AFM image of the flash memory. Cheaper to round up the family and go back to Yellowstone. Any further suggestions? Expecting none, I still want to offer most heartfelt thanks to everyone for their pointers and tips. If *this* group can't help me, it's a testament to how well and truly I managed to screw myself. -- - Mark 210-379-4635 ----------------------------------------------------------------------- Large Asteroids headed toward planets inhabited by beings that don't have technology adequate to stop them: Think of it as Evolution in Fast-Forward.