Data Recovery,MS-DOS files unreadable on a FAT32 HDD?

[Coume]

Hello,

I am in deep sh*t...

Ok, I have a X'Drive which is a portable device in which you put your memory card from digital camera (CF, SD, etc) and press one button to copy the memory card on it.

You can check the copy process on the LCD screen. For the last 4 months, it was always giving me a copy message without error. But last week, when I decided to burn everything on CD, I discovered the BIG PROBLEM...

Basically, I borrowed this portable device to a friend who reformated it as FAT32, when it should have been FAT16. Consequently, the data on it are not readable. Their filenames are wrong and it is not even possible to do a cat on them :/ neither copy, etc.

I am kind of sure that the data are ok, since I can browse the pictures using the LCD to read their filenames, date, size, etc. but there is no way to read them under linux, neither windows.

What do you think I could do to get them back?

Thanks in advance for any tips

Cheers,
Ludo
_________________
MythTVtalk.com - The MythTV Community forum

[NeddySeagoon]

Coume,

The format operation will have destroyed the pointers to the data but much of the data will be intact.
Make an image of the device to a file, then you can start to unpick that.
It will not be easy.

Plug the device into linux and do

[Coume]

Thxs for your quick reply,

I understand the make an image part, but once I have an image of the hdd, what can I do with it???? how can I unpick files? I do not understand the next step sorry

Thxs for helping

Cheers,
Ludo
_________________
MythTVtalk.com - The MythTV Community forum

[NeddySeagoon]

Coume,

I need to understad the exact sequence of events. In particular, when the format took place in relation to the data you want to recover being placed on the device.
The format operation wrote a File Allocation Table showing the filesystem as empty and a new top level directory. Apart from that, all the rest of the data is still there.
Normally the File Allocation Table tells you the order in which disk clusters must be read to read the file. The first clustor if a file is contained in the directory entry for that file, the next cluster, in the FAT entry for that cluster, and so on in a linked list.
On an empty volume, clusters are allocated sequentially - thats an assumption that will be true for most of your files. Its all you have now that the FAT is gone.

FAT16 only allows a fairly small number of files in the root partition (it varies by cluster size), so your directory entries are unlikely to have been stored there.
They will be in sub-directories. If you can find these - you have the starting cluster for each of your images. If they are written sequentailly, The end of one is just before the start of the next. You can use dd the extract this block range to a file, which you can check with The GIMP.

A cluster is 2^n blocks, where n 0..6, depending on the volume size. The entire volume can contain at most, 2^16 clusters, its actually a few less, becaose some values have special meanings like, bad block, unallocated, last cluster in file.
So the following approximations hold goof
For volumes up to 32Mb a cluster = sector =512 bytes (n=0)
For volumes > 32Mb and < 64Mb a cluster = 2 sectors = 1024 bytes (n=1)
For volumes >64Mb and <256 Mb a cluster = 4 sectors = 2048 bytes (n=2)
and so on up to 4Gb, when FAT16 breaks. (Its artiffically limited to 2Gb and 32kb clusters)

If the volume was fragmented its much harder to recover the data becasue the assumption about sequential allocation breaks down.

Since your viewer can recover the images, it can't be using the filesystem - so how does it do it ?
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.