On Fri, 26 Nov 2010 18:18:16 +0100 Alexander Hall <[email protected]> wrote:
> On 11/26/10 16:43, Antoine Jacoutot wrote: > > On Fri, 26 Nov 2010, Predrag Punosevac wrote: > > > >> Dear All, > >> > >> Sorry for this hasty e-mail. I have a Thanksgiving emergency here. > >> Namely, my wife has accidentally erased all the pictures from her > >> Sony camera (FAT 16 file system). Can anybody point me to any > >> forensic tools in ports which can be used to recover the files. The > >> good news is that I didn't allow her to take any photos after she did > >> that as I recall somebody saying here that until files are not overwritten > >> the files are not lost. I also apologize for bad formating of this message. > >> It is sent from the web-interface. > > > > Maybe this: http://www.cgsecurity.org/wiki/PhotoRec > > (never tried) > > I believe it's in sysutils/testdisk. IIRC I've used it very successfully. > > /Alexander > Yep sysutils/testdisk is very easy to use for this case. winternals disk commander is even easier for this filesystem, but obviously not in ports. Look out for "list files" I think and have somewhere ready to copy them to. It's also possible to rebuild the partition table without copying the data off and simply getting it all back, this can even be automated in many cases. You may want to make an image and work on that just to almost guarantee you can't lose any data. I once started to zero my system drive instead of a usb (damn sd? difference between linux os's), that cost me a few hours, it was quite a complicated partition setup that thankfully I'd written down when creating. I got it all back except the first part which was just os data, replaceable from backup too, so I now cat my usbs to null so the light/noise confirms it's the right drive, you can't be too careful when doing these things, especially writing.
