Re: [sleuthkit-users] Undelete files over vfat disk partition.

[Brian C. <ca...@sl...>]

The recovery will depend on how fragmented the files originally were.=20
To recover files from FAT, a recovery tool will need to piece each=20
sector / cluster together.  One incorrectly placed sector could make the=20
recovered file unusable.

You can try to use TSK / Autopsy to see if the names for the deleted=20
files exist and they can be recovered.  You may also need to try some=20
data carving tools, which look for known headers and footers for=20
specific file types.  An example of an open source and free carving tool=20
is scalpel.

And, no you should not mount the partition until you have tried to=20
recover the files.

brian

BRE...@te... wrote:
> Hello, last night trying to delete a file I deleted all the files (larg=
e=20
> files) in a subdirectory on an VFAT file system mounted in my Fedora=20
> Core 4 installation (W-XP shared). I rebooted the system and the=20
> partition remounted for a while until I dismounted manually: this=20
> partition is only used as a repository so I would not expect all these=20
> blocks (around 15 GB) have been overwritten.
> The obvious questions are :
> how can I check is the files can be undeleted?
> how can I undelete securely all these files?
> I assume I should not mount it anymore.
>=20
> Thanks in advance.
>=20
>=20
>=20
>=20
> **Prueba el Nuevo Correo Terra; Seguro, r=C3=A1pido, fiable.**=20
> <http://www.terra.es/correo>
>=20
>=20
> -----------------------------------------------------------------------=
-
>=20
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org