Date: Fri, 20 Mar 2009 03:29:36 +0100 From: Polytropon <freebsd@edvax.de> To: Fbsd1 <fbsd1@a1poweruser.com> Cc: FreeBSD Questions <freebsd-questions@freebsd.org> Subject: Re: recover data from damaged msdos fat32 partition Message-ID: <20090320032936.44fd1e41.freebsd@edvax.de> In-Reply-To: <49C2FA05.5070606@a1poweruser.com> References: <494CA9E6.6050501@a1poweruser.com> <20081222025247.9225e612.freebsd@edvax.de> <49C2FA05.5070606@a1poweruser.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, 20 Mar 2009 10:05:57 +0800, Fbsd1 <fbsd1@a1poweruser.com> wrote: > I have installed these ports > > autopsy > dd_rescue > ddrescue > fatback > formost > sleuthkit > > If my understanding of reading their documentation is correct, they all > need a empty disk to copy the bad disk sectors to in sequence. > Is this a correct understanding? It is. These tools work in a non-destructive way, this means their (eventually failing) attempts to recover data do not do any damage to the original (defective) disk. The defective disk isn't repaired, that would be too dangerous to try. I would even mention to first make a 1:1 dd copy of the defective FAT partition and using those tools with the copy, not with the original. > msdos fat32 file system has a backup fat table as stated in the docs. Do > any of the sectors rescue programs read the backup fat table? dd_rescue - No, does simply copy the partition 1:1. ddrescue - The same. sleuthkit - Usually work on a lower level. formost - Works on a lower level and extracts data files by magic. autopsy - Offers a "server" for forensic browsing. fatback - Kind of "undelete tool", no. The TSK's tools dls, fls and ils don't seem to offer the option in question. I read about using alternate superblocks, but that refers to the UFS file system and not the 2nd FAT. Maybe it's possible to exactly locate and extract this backup FAT first and then replace the defective FAT with this copy, using tools like dd? > Not interested in the XP system or programs directors. Just want user > data files created by adobe pagemaker. Dont know what the file extension > is for sure or if there are any way to ID the file from internal > content. Best guess I have on file extension is .cv5 Do not have a file > to examen. The recovery utilities that act by magic aren't interested in the file name extension. From the manuals of the programs listed above that mention such a functionality, there's no word about "Adobe Pagemaker". Would it have been generic files (such as JPG files for images, TeX / text files for text), or some kind of ODF archive, it would be much easier. > What are the general steps I need to do to recover data from this msdos > FAT32 disk with corrupted fat table and maybe corrupted data? First, copy the partition: % ddrescue /dev/ad0s2 fat.dd I'm not sure how the msdosfs formatted disk / the FAT partition will show up as device file in FreeBSD. In the result, you can unplug the disk / remove it and only work with the copy. Then, you can start extracting data from it, for example with % mkdir retrieve % foremost -i fat.dd -v -o retrieve -t all The manpage of foremost has some examples, too. The manpage of fatback isn't great, "info fatback" has more details. For TSK, use something like this: % dls -t raw -f fat -v fat.dd I've got no FAT partitions (defective or intact) at hand so I cannot check if this really works as I think it should. :-) -- Polytropon >From Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20090320032936.44fd1e41.freebsd>