>>> vladas 6-Jul-06 13:46 >>> > > Thank you for your replies. I was not clear enough in the first place: > due to the first 10Mb being gone, I do not expect to find any valid fs > anymore. What I still hope for are individual files from the 3Gb image > file that I have. I mean e.g. exe's, or dll's, zip's, lha's etc should > have their size written in them or their data structures, not only fs, > as well. > > So that e.g. for exe's I would find their "MZ" beginning chars, size > after them and seek until the end by the size. Its gonna be time > consuming, I know. That is why I asked in the first place.
It is true that the data from most of your files will still be on the disk. However, the FAT filesystem does not store each file contiguously, but in chunks called clusters. The maximum cluster size on a FAT filesystem is 32KB. Files that are not fragmented will have their clusters adjacent on the disk, but if the disk has been in use for a while, many files will have their clusters spread out across the disk. The metadata that the FAT filesystem uses to say which clusters form each file is the FAT, which is in the first part of the disk, and therefore no longer available in your case: Your disk will have a cluster size of 32KB (the maximum permitted by the specification) and a FAT with 32-bit entries. There will need to be 98,000 (approx) entries in the FAT (3 GB / 32 KB). 256 32-bit FAT entries fit in 1 KB, so the FAT will have taken up 380 KB or so. Even though there are usually two copies of the FAT, both will be gone. > I dared to ask about it on misc@ because I thought that mount_msdos > might be more helpful in this case. Sadly, with the FAT and other control structures gone you are down to looking for needles in your 3 GB haystack. Of course, if the FAT filesystem didn't start in the first 10 MB of the disk, you are much more likely to be able to recover your data. Otherwise, depending on the data you're looking for, strings(1) may help :( Or you may need to look for Unicode strings (typically with every other byte being 0). Good luck Tom
