Re: [sleuthkit-users] Recovering deleted file from fat32

[Brian C. <ca...@sl...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On Jul 7, 2004, at 12:26 PM, Anne Wilson wrote:

> On Wednesday 07 Jul 2004 17:49, Brian Carrier wrote:
>>
>> If the file can be recovered, then you can 'export' the file and then
>> copy it back to its original location.  Use the latest autopsy and TSK
>> because they have FAT file recovery.  They do not do file recovery in
>> the classical sense because their primary focus is to examine a raw
>> image of the disk and they have no write support in them at all.
>>
> Thanks for the reply, Brian.  I think my copy (with Mandrake 10) 
> mustn't be
> the latest, then.  In the end I used fatback to recover them.  
> However, for
> future reference -
>
> I could see the files in autopsy, but attempting to export them 
> resulted in,
> for instance, bankrec.xls which appears to be a raw file and cannot be 
> read
> by any of the spreadsheet programs I have.  Could I have sorted this?

If you don't have the latest version (TSK v1.70), then exporting a 
deleted FAT file will give you only the first cluster.  Using 1.70 will 
export the entire file if it can be recovered.

brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFA7MNrOK1gLsdFTIsRAiOlAJ94sVA2yf+nXdm7kAKG5F3nE2drDwCdHiGC
9V1SG8hbjMXdZhC3FVOjRC0=
=QkXv
-----END PGP SIGNATURE-----