Spelunking the places where files are not

[Tor Arntsen]

On Fri, 5 Mar 2021 at 15:41, John Foust via cctalk
<cctalk at classiccmp.org> wrote:
>
>
> After thinking about disk imaging tools like Greaseweasel,
> I started thinking about tools that would grab and examine the unused
> portions of disks.
>
> It's obviously file-system dependent.  At one level we know of
> "undelete" tools that could piece together recently deleted files
> and restore them intact by using abandoned bits of block table info.
> Of course some simple file systems can't even permit that.

Linux distros come with a standard tool to do some of that,
'testdisk'. From the overview:

"Partition scanner and disk recovery tool"

 It works with :
  * DOS/Windows FAT12, FAT16 and FAT32
  * NTFS ( Windows NT/2K/XP )
  * Linux Ext2 and Ext3
  * BeFS ( BeOS )
  * BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
  * CramFS (Compressed File System)
  * HFS and HFS+, Hierarchical File System
  * JFS, IBM's Journaled File System
  * Linux Raid
  * Linux Swap (versions 1 and 2)
  * LVM and LVM2, Linux Logical Volume Manager
  * Netware NSS
  * ReiserFS 3.5 and 3.6
  * Sun Solaris i386 disklabel
  * UFS and UFS2 (Sun/BSD/...)
  * XFS, SGI's Journaled File System
 .
 PhotoRec is file data recovery software designed to recover
 lost pictures from digital camera memory or even Hard Disks.
 It has been extended to search also for non audio/video headers.
 It searches for following files and is able to undelete them:
  * Sun/NeXT audio data (.au)
  * RIFF audio/video (.avi/.wav)
  * BMP bitmap (.bmp)
  * bzip2 compressed data (.bz2)
  * Source code written in C (.c)
  * Canon Raw picture (.crw)
  * Canon catalog (.ctg)
  * FAT subdirectory
  * Microsoft Office Document (.doc)
  * Nikon dsc (.dsc)
  * HTML page (.html)
  * JPEG picture (.jpg)
  * MOV video (.mov)
  * MP3 audio (MPEG ADTS, layer III, v1) (.mp3)
  * Moving Picture Experts Group video (.mpg)
  * Minolta Raw picture (.mrw)
  * Olympus Raw Format picture (.orf)
  * Portable Document Format (.pdf)
  * Perl script (.pl)
  * Portable Network Graphics (.png)
  * Raw Fujifilm picture (.raf)
  * Contax picture (.raw)
  * Rollei picture (.rdc)
  * Rich Text Format (.rtf)
  * Shell script (.sh)
  * Tar archive (.tar )
  * Tag Image File Format (.tiff)
  * Microsoft ASF (.wma)
  * Sigma/Foveon X3 raw picture (.x3f)
  * zip archive (.zip)

I haven't used the tool recently, but some ten-fifteen years ago there
was for some reason much more disk trouble and I used the tool
effectively to recover lost data and partitions.