Re: [sleuthkit-users] Recovering deleted file from fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 4, 2004, at 7:20 AM, Anne Wilson wrote:

> After an accident involving a fan failure I am left with whole 
> directories
> apparently lost.  Using Autopsy, however, I have confirmed that the 
> files are
> still there and intact.  I can see the files I need, with just the 
> first
> letter missing.  However, I can't see how I can recover them.  I 
> presume that
> there is some way in which I can rename these to the original name and 
> save
> them - maybe to a different directory?

If the file can be recovered, then you can 'export' the file and then 
copy it back to its original location.  Use the latest autopsy and TSK 
because they have FAT file recovery.  They do not do file recovery in 
the classical sense because their primary focus is to examine a raw 
image of the disk and they have no write support in them at all.

brian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7CmcOK1gLsdFTIsRAvemAJ9Y5ph+qi5jJ80vDx2IJTC4INe4/gCdFEDJ
JfV5ovZQj/mk5NbMS8pLvys=
=5v2Q
-----END PGP SIGNATURE-----