Spelunking the places where files are not
John Foust
jfoust at threedee.com
Mon Mar 8 09:38:31 CST 2021
At 03:16 AM 3/8/2021, Tor Arntsen via cctalk wrote:
>Linux distros come with a standard tool to do some of that,
>'testdisk'. From the overview:
I'm familiar with the various undelete tools for Windows and Linux.
Such tools may not exist or make sense for older file systems.
Entire files would be great to find, but I suspect interesting
fragments may be more likely.
Running a Windows-based tool like Recuva on a hard drive leads
to such a firehose of fragments if you choose the deep scan that
examines all unused blocks. I've only tried the free version.
Does the pro version give you a way to exclude all the dozens
of OS file types that are probably not the user-made files
that you want?
And for the archaic disk formats, it would be good to have
platform-specific methods of identifying fragments to guess
their file type beyond executable and ASCII. Older run-length
compression image formats may be more possible to recover than
today's block-compressed images.
- John
More information about the cctalk
mailing list