On Mon, 8 Mar 2021, John Foust via cctalk wrote:
I'm familiar with the various undelete tools for Windows and Linux. Such tools may not exist or make sense for older file systems.
Windows/MS-DOS was certainly not unique nor original in marking file primary directory entries (FPDE) as deleted, without removing all traces. CP/M, for instance maintains most of the FPDE. Look in the directory sectors for entries starting with 00 or E5.
UCSD P-System is easy, until the disk has been CRUNCH'ed.
Entire files would be great to find, but I suspect interesting fragments may be more likely.
AS Chuck pointed out, when a file does not fill the remaining space in the last block that is allocated to it, that space MIGHT contaian residual content from previous use. Yes, the OS will usually write complete sectors (may or may not contain unused portion of sector buffer content!), and overwrite the rest of the last SECTOR, but it is unlikely to clear out the unused sectors in that last block.
Running a Windows-based tool like Recuva on a hard drive leads to such a firehose of fragments if you choose the deep scan that examines all unused blocks. I've only tried the free version. Does the pro version give you a way to exclude all the dozens of OS file types that are probably not the user-made files that you want?
I'd recommend a two stage process. Make files out of all of those fragments. THEN, use other tools to select which of those fragments contain the type of content that you are looking for. On something as small as a floppy, of course, a human is cost effective.
And for the archaic disk formats, it would be good to have platform-specific methods of identifying fragments to guess their file type beyond executable and ASCII. Older run-length compression image formats may be more possible to recover than today's block-compressed images.
PROJECT: Create a program that will take a list of files, and partial files, and for each one, identify the file type, and attempt to display the content. There are thousands of file formats to implement. Knowledge of those file formats, and especially their headers, is essential. Obviously, file headers and beginnings of files may be easier to identify than random pieces from the middle. For example, in MS-DOS/Windoze, a file that starts with "MZ" (Mark Zbikowski) is almost always an .EXE file. Fortunately, most of the older file formats were simpler, and word processing files had lots of text strings in them.
-- Grumpy Ol' Fred ci...@xenosoft.com
