Spelunking the places where files are not

John Foust jfoust at threedee.com
Mon Mar 8 09:38:31 CST 2021


At 03:16 AM 3/8/2021, Tor Arntsen via cctalk wrote:
>Linux distros come with a standard tool to do some of that,
>'testdisk'. From the overview:

I'm familiar with the various undelete tools for Windows and Linux.  
Such tools may not exist or make sense for older file systems.

Entire files would be great to find, but I suspect interesting
fragments may be more likely.

Running a Windows-based tool like Recuva on a hard drive leads
to such a firehose of fragments if you choose the deep scan that
examines all unused blocks.  I've only tried the free version.
Does the pro version give you a way to exclude all the dozens
of OS file types that are probably not the user-made files 
that you want?

And for the archaic disk formats, it would be good to have 
platform-specific methods of identifying fragments to guess
their file type beyond executable and ASCII.  Older run-length
compression image formats may be more possible to recover than
today's block-compressed images.

- John



More information about the cctech mailing list