Spelunking the places where files are not
Tor Arntsen
kspt.tor at gmail.com
Mon Mar 8 03:16:20 CST 2021
On Fri, 5 Mar 2021 at 15:41, John Foust via cctalk
<cctalk at classiccmp.org> wrote:
>
>
> After thinking about disk imaging tools like Greaseweasel,
> I started thinking about tools that would grab and examine the unused
> portions of disks.
>
> It's obviously file-system dependent. At one level we know of
> "undelete" tools that could piece together recently deleted files
> and restore them intact by using abandoned bits of block table info.
> Of course some simple file systems can't even permit that.
Linux distros come with a standard tool to do some of that,
'testdisk'. From the overview:
"Partition scanner and disk recovery tool"
It works with :
* DOS/Windows FAT12, FAT16 and FAT32
* NTFS ( Windows NT/2K/XP )
* Linux Ext2 and Ext3
* BeFS ( BeOS )
* BSD disklabel ( FreeBSD/OpenBSD/NetBSD )
* CramFS (Compressed File System)
* HFS and HFS+, Hierarchical File System
* JFS, IBM's Journaled File System
* Linux Raid
* Linux Swap (versions 1 and 2)
* LVM and LVM2, Linux Logical Volume Manager
* Netware NSS
* ReiserFS 3.5 and 3.6
* Sun Solaris i386 disklabel
* UFS and UFS2 (Sun/BSD/...)
* XFS, SGI's Journaled File System
.
PhotoRec is file data recovery software designed to recover
lost pictures from digital camera memory or even Hard Disks.
It has been extended to search also for non audio/video headers.
It searches for following files and is able to undelete them:
* Sun/NeXT audio data (.au)
* RIFF audio/video (.avi/.wav)
* BMP bitmap (.bmp)
* bzip2 compressed data (.bz2)
* Source code written in C (.c)
* Canon Raw picture (.crw)
* Canon catalog (.ctg)
* FAT subdirectory
* Microsoft Office Document (.doc)
* Nikon dsc (.dsc)
* HTML page (.html)
* JPEG picture (.jpg)
* MOV video (.mov)
* MP3 audio (MPEG ADTS, layer III, v1) (.mp3)
* Moving Picture Experts Group video (.mpg)
* Minolta Raw picture (.mrw)
* Olympus Raw Format picture (.orf)
* Portable Document Format (.pdf)
* Perl script (.pl)
* Portable Network Graphics (.png)
* Raw Fujifilm picture (.raf)
* Contax picture (.raw)
* Rollei picture (.rdc)
* Rich Text Format (.rtf)
* Shell script (.sh)
* Tar archive (.tar )
* Tag Image File Format (.tiff)
* Microsoft ASF (.wma)
* Sigma/Foveon X3 raw picture (.x3f)
* zip archive (.zip)
I haven't used the tool recently, but some ten-fifteen years ago there
was for some reason much more disk trouble and I used the tool
effectively to recover lost data and partitions.
More information about the cctech
mailing list