UNFORMAT ? - Linux

This is a discussion on UNFORMAT ? - Linux ; Hallo, A Friend of mine did accidently delete his photos from vacation on the SD card with his camera. Id just took half a second and they were gone. Within half a second the camera cannot have deleted all memory ...

+ Reply to Thread
Results 1 to 10 of 10

Thread: UNFORMAT ?

  1. UNFORMAT ?

    Hallo,

    A Friend of mine did accidently delete his photos from vacation on the SD
    card with his camera. Id just took half a second and they were gone.
    Within half a second the camera cannot have deleted all memory
    but probably just instead deleted the root directory(maybe the FAT)
    I can remember that there was a tool in the past in MSDOS which was called
    UNFORMAT where you could restore the data by giving the first character
    of the file.

    Does such a tool still exist nowadays ?
    I am working with linux and i have taken a complete 2G Image of the SD
    card.

    Can anybody help me ?


  2. Re: UNFORMAT ?

    Guenther Sohler writes:
    > A Friend of mine did accidently delete his photos from vacation on the SD
    > card with his camera. Id just took half a second and they were gone.
    > Within half a second the camera cannot have deleted all memory
    > but probably just instead deleted the root directory(maybe the FAT)
    > I can remember that there was a tool in the past in MSDOS which was called
    > UNFORMAT where you could restore the data by giving the first character
    > of the file.
    >
    > Does such a tool still exist nowadays?


    Presumably somewhere. But if this is really a DOS filesystem, deleting
    a file just means replace the first character of its name with 0x3e
    and this can be reverted with any hex editor.

  3. Re: UNFORMAT ?

    Rainer Weikusat writes:
    > Guenther Sohler writes:
    >> A Friend of mine did accidently delete his photos from vacation on the SD
    >> card with his camera. Id just took half a second and they were gone.
    >> Within half a second the camera cannot have deleted all memory
    >> but probably just instead deleted the root directory(maybe the FAT)
    >> I can remember that there was a tool in the past in MSDOS which was called
    >> UNFORMAT where you could restore the data by giving the first character
    >> of the file.
    >>
    >> Does such a tool still exist nowadays?

    >
    > Presumably somewhere. But if this is really a DOS filesystem, deleting
    > a file just means replace the first character of its name with 0x3e


    s/3e/e5

  4. Re: UNFORMAT ?

    Guenther Sohler wrote:
    > A Friend of mine did accidently delete his photos from vacation on the SD
    > card with his camera. Id just took half a second and they were gone.
    > Within half a second the camera cannot have deleted all memory
    > but probably just instead deleted the root directory(maybe the FAT)
    > I can remember that there was a tool in the past in MSDOS which was called
    > UNFORMAT where you could restore the data by giving the first character
    > of the file.


    > Does such a tool still exist nowadays ?
    > I am working with linux and i have taken a complete 2G Image of the SD
    > card.


    Just from at least 10-year old memory: Deleting a FAT file just
    replaced the first byte of the file name in the directory table
    entry by 0xE5. As long as you didn't create new files (which
    would reuse the directory entry and/or the associated sectors)
    you could "undelete" a file by simply resetting the 0xE5 by a
    "real" character. Finding the directory table should not be too
    difficult if you remember a few file names (but I seem to remem-
    ber that the dot seperating the file name from the extension was
    not stored in the file name and file names with less than 8 cha-
    racters where padded with spaces, so if the file name was "abc.exe"
    you had to search for "abc exe", note the five spaces in there).
    To get it really right you had to check that you didn't "revive"
    files that were really deleted in the sense that their sectors
    were already reused, but here you can probably leave it to your
    friend to look through the files and check which of them are still
    usable;-) Much luck!
    Regards, Jens
    --
    \ Jens Thoms Toerring ___ jt@toerring.de
    \__________________________ http://toerring.de

  5. Re: UNFORMAT ?

    On 12 Jul 2008 08:48:39 GMT Jens Thoms Toerring wrote:

    | Guenther Sohler wrote:
    |> A Friend of mine did accidently delete his photos from vacation on the SD
    |> card with his camera. Id just took half a second and they were gone.
    |> Within half a second the camera cannot have deleted all memory
    |> but probably just instead deleted the root directory(maybe the FAT)
    |> I can remember that there was a tool in the past in MSDOS which was called
    |> UNFORMAT where you could restore the data by giving the first character
    |> of the file.
    |
    |> Does such a tool still exist nowadays ?
    |> I am working with linux and i have taken a complete 2G Image of the SD
    |> card.
    |
    | Just from at least 10-year old memory: Deleting a FAT file just
    | replaced the first byte of the file name in the directory table
    | entry by 0xE5. As long as you didn't create new files (which
    | would reuse the directory entry and/or the associated sectors)
    | you could "undelete" a file by simply resetting the 0xE5 by a
    | "real" character. Finding the directory table should not be too
    | difficult if you remember a few file names (but I seem to remem-
    | ber that the dot seperating the file name from the extension was
    | not stored in the file name and file names with less than 8 cha-
    | racters where padded with spaces, so if the file name was "abc.exe"
    | you had to search for "abc exe", note the five spaces in there).
    | To get it really right you had to check that you didn't "revive"
    | files that were really deleted in the sense that their sectors
    | were already reused, but here you can probably leave it to your
    | friend to look through the files and check which of them are still
    | usable;-) Much luck!

    Before making any such changes directly on the SD card, I recommend making
    a complete image backup of the card. first.

    Assuming the card becomes /dev/sdc when inserted into a Linux system, you
    can do this:

    gzip -9 < /dev/sdc > ~/bad-sd-card-backup.img.gz

    Verify the backup is good:

    gunzip < ~/bad-sd-card-backup.img.gz | md5sum - /dev/sdc

    This can take a while depending on card size and system speed. Hopefully you
    have enough space even after compression (it won't compress too much if the
    card has ever been filled up with pictures).

    You can mount the disk on Linux to test your hex editing (do this as root):

    mkdir /media/sd
    mount -r -t msdos /dev/sdc1 /media/sd

    If you find you need to restore the card to its original bad state and start
    all over and try fixing it a different way, use the backup:

    gunzip < ~/bad-sd-card-backup.img.gz > /dev/sdc

    --
    |WARNING: Due to extreme spam, googlegroups.com is blocked. Due to ignorance |
    | by the abuse department, bellsouth.net is blocked. If you post to |
    | Usenet from these places, find another Usenet provider ASAP. |
    | Phil Howard KA9WGN (email for humans: first name in lower case at ipal.net) |

  6. Re: UNFORMAT ?

    Thank you for your reply,

    but first of all i encounter a different problem.

    I just got the image of the sd card. the sd card is gone(my friend is
    gone and not available). I put the 2G image file onto my 1 GB USB stick
    (assuming the 2nd half is not needed) but now i encounter
    disc geometry problems and fsck.msdos finds 192 fats

    however looking into the image, the filenames seem completely ok,
    the just seem not be accessible from the root filesystem.

    rds

    O

  7. Re: UNFORMAT ?

    Guenther Sohler burped up warm pablum in
    news:48786110$0$16174$5402220f@news.sunrise.ch:

    > Hallo,
    >
    > A Friend of mine did accidently delete his photos from vacation on the
    > SD card with his camera. Id just took half a second and they were
    > gone. Within half a second the camera cannot have deleted all memory
    > but probably just instead deleted the root directory(maybe the FAT)
    > I can remember that there was a tool in the past in MSDOS which was
    > called UNFORMAT where you could restore the data by giving the first
    > character of the file.
    >
    > Does such a tool still exist nowadays ?
    > I am working with linux and i have taken a complete 2G Image of the SD
    > card.
    >
    > Can anybody help me ?
    >


    Yes! Look for a set of tools called "photorec" and "testdisk." It can use your 2 GiB image to extract all of the files from almost any popular file system in use.

    --
    Tris Orendorff
    [ Anyone naming their child should spend a few minutes checking rhyming slang and dodgy sounding names. Brad and Angelina failed to do this when naming their kid Shiloh Pitt. At some point, someone at school is going to spoonerise her name.
    Craig Stark ]


  8. Re: UNFORMAT ?

    On 12 Jul 2008 18:42:16 GMT Guenther Sohler wrote:

    | Thank you for your reply,
    |
    | but first of all i encounter a different problem.
    |
    | I just got the image of the sd card. the sd card is gone(my friend is
    | gone and not available). I put the 2G image file onto my 1 GB USB stick
    | (assuming the 2nd half is not needed) but now i encounter
    | disc geometry problems and fsck.msdos finds 192 fats

    There is no gurantee that some MSDOS-FS implementation won't allocate sectors
    in reverse order, or random order, or added-wear-leveling order (two layers
    of wear leveling can improve things).

    If you have no 2G device, then I suggest copying the first partition of the
    image (you need to know the sector offset and length and use "dd" for this)
    to another file, and mounting that file read-only with loopback.


    | however looking into the image, the filenames seem completely ok,
    | the just seem not be accessible from the root filesystem.

    They have been deleted. Maybe the subdirectory they are in has been deleted.

    --
    |WARNING: Due to extreme spam, googlegroups.com is blocked. Due to ignorance |
    | by the abuse department, bellsouth.net is blocked. If you post to |
    | Usenet from these places, find another Usenet provider ASAP. |
    | Phil Howard KA9WGN (email for humans: first name in lower case at ipal.net) |

  9. Re: UNFORMAT ?

    Thank you for the hints,

    i have now recoered 80% of the photos.
    I read a lot of fat16 documentation and matched it to the image.
    There happended a format which has rewritten both fats and the root
    directory.
    but the subdirectory with the fotos was still present.
    so i extracted the cluster number, filename and filesize each and
    assuming that the clusters are ordered subsequently i was able to write
    a c program to extract the data.
    20% of the images are corrupt now as the fat was not linear in these
    places.
    but this is ok for me. thank you for your help!

  10. Re: UNFORMAT ?

    Keep Linux free
    Spam and smoke free as well



    Guenther Sohler wrote:
    > Thank you for the hints,
    >
    > i have now recoered 80% of the photos.
    > I read a lot of fat16 documentation and matched it to the image.
    > There happended a format which has rewritten both fats and the root
    > directory.
    > but the subdirectory with the fotos was still present.
    > so i extracted the cluster number, filename and filesize each and
    > assuming that the clusters are ordered subsequently i was able to write
    > a c program to extract the data.
    > 20% of the images are corrupt now as the fat was not linear in these
    > places.
    > but this is ok for me. thank you for your help!


+ Reply to Thread