On 26/11/10 16:37, Kevin Chadwick wrote: > On Fri, 26 Nov 2010 18:18:16 +0100 > Alexander Hall <[email protected]> wrote: > >> On 11/26/10 16:43, Antoine Jacoutot wrote: >>> On Fri, 26 Nov 2010, Predrag Punosevac wrote: >>> >>>> Dear All, >>>> >>>> Sorry for this hasty e-mail. I have a Thanksgiving emergency here. >>>> Namely, my wife has accidentally erased all the pictures from her >>>> Sony camera (FAT 16 file system). Can anybody point me to any >>>> forensic tools in ports which can be used to recover the files. The >>>> good news is that I didn't allow her to take any photos after she did >>>> that as I recall somebody saying here that until files are not overwritten >>>> the files are not lost. I also apologize for bad formating of this message. >>>> It is sent from the web-interface. >>> Maybe this: http://www.cgsecurity.org/wiki/PhotoRec >>> (never tried) >> I believe it's in sysutils/testdisk. IIRC I've used it very successfully. >> >> /Alexander >> > Yep sysutils/testdisk is very easy to use for this case. winternals > disk commander is even easier for this filesystem, but obviously not in > ports. > > Look out for "list files" I think and have somewhere ready to copy them > to. It's also possible to rebuild the partition table without copying > the data off and simply getting it all back, this can even be > automated in many cases. You may want to make an image and work on that > just to almost guarantee you can't lose any data. I once started to > zero my system drive instead of a usb (damn sd? difference between > linux os's), that cost me a few hours, it was quite a complicated > partition setup that thankfully I'd written down when creating. I got > it all back except the first part which was just os data, replaceable > from backup too, so I now cat my usbs to null so the light/noise > confirms it's the right drive, you can't be too careful when doing > these things, especially writing. >
Nice idea con cat to null and verify which light turns on, nothing could be safer :-) -- Hugo Osvaldo Barrera
