0

In pset 4 we were suppose to recover images deleted from a camera memory card by means of reading card.raw and writing the jpeg data when a signature was found. Now suppose I want to recover data deleted from a normal directory on my computer.I know of course that fat32 systems doesn't delete the actual data of a deleted file but rather it deletes the refrence pointing to it. How would I know which file to point to using fopen. what is a substitute for card.raw or how would I create a similar type of file?

1

You would have to read and interpret the partition, or device if it does not use partitions, not a file of the filesystem, as the file system driver might not provide any way to address "free" space as files.

The .raw file is essentially a copy of such a partition/device, containing the file system.

On Linux, devices reside in the /dev/ directory, for example /dev/sdc2 for the second partition (2) of the third (c) SCSI-device (s for SCSI, h would stand for IDE). There's also /dev/sdc, which addresses the whole disk, including partition table and all its partitions. Not sure how GPT works, I'm used to MS-DOS style regular partition table found in the MBR.

You can use dd command to copy block-wise, for example to create an image of the filesystem, or to restore it.

Please be aware of file fragments, if you delete single files and save others, or append to an existing file, those might be split into multiple parts, and even great tools like TestDisk often cannot guess which fragment belongs to which file.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .