On 07/07/06, Joachim Schipper <[EMAIL PROTECTED]> wrote:
On Thu, Jul 06, 2006 at 08:56:55PM +0900, vladas wrote:
> Hi all.
>
> I have f****d up the first 10Mb of the 3Gb fat disk
> (not partition, the whole 3Gb disk) full of windoze
> shit. Then, due to time limits, made some of sort
> of backup of the mess with dd and put Puffy into
> that disk (dedicated install). The problem is that
> management needs some of that stuff back <..>.
>
> I would be grateful if anybody could give any hints
> on how to grep the 3Gb backup image for any msdosfs
> patterns so that I could get at least some of the
> individual files back. Sorry for asking it like that
> instead of just reading mount_msdos src silently
> - maybe someone had this before..
>
> I am posting this to misc@ because Puffy is the
> only OS I run.
>
> Would be grateful for any hint etc.
'Keep backups' is the best one, but probably a bit late. (Unless you
were told you could delete the data, in which case a clue by four might
be appropriate.)
Several good suggestions have already been given, so I'll not repeat
them.
Aside from Wietse Venema's The Coroner's Toolkit (TCT), there is also
the Sleuth Kit. It's more modern and presumably has a more friendly
interface (TCT, while a good tool, does not quite shine there). I am
fairly certain it does FAT as well, but I have no clue if it would work
in this case - it's really meant for finding deleted/hidden files in
intact filesystems. However, at least 'sigfind' from the Sleuth Kit
might be useful, if you know what you are looking for (and willing to
spend lots of time).
However, in case you only destroyed the partition table, but not the
partition in question (i.e., the partition you want to recover data
from), I have had personal success with a Knoppix disk, a loopback
device with an offset
Tried this in the very first place with no result. First 10Mb appeared
to be a lot:)
(this does not seem to be supported on OpenBSD),
and just mounting it. Of course, one could simulate this on OpenBSD by
exploiting the magic of dd(1), vnd(4), and mount_msdos(8), too.
Of course, this requires you to know the exact starting byte of the
filesystem, but other tools exist to help with that. In this case,
someone who shut down Partition Magic because it was taking too long,
it worked just fine, over the phone no less.
Joachim
Thank you for all these good ideas.
I will check them out.
vladas
