Re: [gentoo-user] Data Recovery NEEDED, very important
> Hi Redeeman, > > Nachricht vom Sonntag, 2. November 2003, 13:20:49: >> PLEASE PLEASE PLEASE help >> i will apreciate ANYTHING, and i am willing to pay if some of you can help If this is *really* important, then you should shutdown the machine in question, and call a professional data recovery company. In the UK, there is one called Vogon who have a very good reputation, perhaps they have a branch in your country? It might cost a lot of money, but if the lost data is that important, it is worth it. If you think you might be willing to pay a company to do this, it is important not to mess around too much beforehand - you might just stomp the data and reduce the chances of ever seeing it again. Gareth -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
Hi Redeeman, Nachricht vom Sonntag, 2. November 2003, 13:20:49: > something happend, and i lost all files in a dir, i think i know what > happend: > i had made a link to the directory in a dir, so that i could share it on > ftp, but when i removed the link, the dirs content got deleted too, its > around 12gb og zip archives, and windows executables. > i have NOT wrote to the disk since, in hope it can get recovered, i had > a situation before: > i had deleted some files in windows though, and i tried ontracks tool, > it found files, but with the name b0rked, but runtimes software found > with the correct name, this time i tried ontracks and the name was > borked again, but runtimes didnt find anything, not even the files on > the dir beyond, so i guess runtimes tool is capable of doing it, but > maybe some stuff is needed in order to do it. > some of you know how i might be able to recover? maybe its best with a > linux tool? the filesystem is fat32 > PLEASE PLEASE PLEASE help > i will apreciate ANYTHING, and i am willing to pay if some of you can > help I would suggest you copy the whole drive bit-wise to another drive of the same size (or bigger) using dd dd if=/dev/brokendrive of=/dev/newdrive You'll then have a copy to work on. Also I have had good results with CIA Unerase http://esd.element5.com/product.html?cart=1&productid=502983¤cies=USD but that is commercial. They have a test-version that'll show you which files will be recoverable to what percentage. HTH Timo -- [EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 09:21 pm, Chris wrote: (B> On Sunday 02 November 2003 09:16 am, Jason Stubbs wrote: (B> > On Sunday 02 November 2003 23:29, Jason Stubbs wrote: (B> > > On Sunday 02 November 2003 22:54, Jason Stubbs wrote: (B> > > > On Sunday 02 November 2003 21:20, Redeeman wrote: (B> > > > > something happend, and i lost all files in a dir, i think i know (B> > > > > what happend: (B> > > > > i had made a link to the directory in a dir, so that i could share (B> > > > > it on ftp, but when i removed the link, the dirs content got (B> > > > > deleted too, its around 12gb og zip archives, and windows (B> > > > > executables. i have NOT wrote to the disk since, in hope it can get (B> > > > > recovered, i had a situation before: (B> > > > > (B> > > > > i had deleted some files in windows though, and i tried ontracks (B> > > > > tool, it found files, but with the name b0rked, but runtimes (B> > > > > software found with the correct name, this time i tried ontracks (B> > > > > and the name was borked again, but runtimes didnt find anything, (B> > > > > not even the files on the dir beyond, so i guess runtimes tool is (B> > > > > capable of doing it, but maybe some stuff is needed in order to do (B> > > > > it. (B> > > > > (B> > > > > some of you know how i might be able to recover? maybe its best (B> > > > > with a linux tool? the filesystem is fat32 (B> > > > (B> > > > Your best bet would be to not touch it at all. There's a few tools on (B> > > > linux that'll allow you to edit at the block level. Read up on them (B> > > > and use them to look at the filesystem. At the same time search (B> > > > around for information on the structure of the fat32 filesystem. (B> > > > Learn it while looking at a live filesystem at the block level and (B> > > > then when you're confident that you know what you are doing, you can (B> > > > attempt (B> > > > restoration. If it doesn't work, then you know you can change it back (B> > > > and start over. (B> > > > (B> > > > Personally, I don't know much about the FAT(32) file-system. The only (B> > > > filesystem I was ever 100% familiar with was BAM (used on the C-64!) (B> > > > but what I do know of FAT16 is that files are marked as deleted by (B> > > > replacing the first character of the filename in the directory table (B> > > > and then marking the occupying blocks as free in the allocation (B> > > > table. I don't know what the implications are for the long-file-names (B> > > > aspect. Once the directory entries are restored, doing a regular (B> > > > Windows scandisk should pick up that the occupying blocks are marked (B> > > > as unallocated and mark them as allocated in the allocation table. (B> > > (B> > > A further thought... don't touch the disk with Windows until you've got (B> > > the data of it. When you try accessing it use "mount -t vfat -o ro" (B> > > under Linux to ensure that the partition is not touched. (B> > > (B> > > Also, a very good description of the FAT12/16/32 filesystems can be (B> > > found here: (B> > > http://home.freeuk.net/foxy2k/disk/disk1.htm (B> > (B> > Forget all that I've said. Unless you've got a _lot_ of time, you have to (B> > reconstruct which clusters belong to which file and in what order if (B> > doing it manually. I'd like to know how the undelete programs (B> > successfully (?) figure that! Anyway, I found this Q&A with several links (B> > (and links to links) that should find you something that will work. If (B> > you have the space to spare, maybe you should use dd from linux to back (B> > up the raw partition first? Anyway, check here: (B> > (B> > http://beta.experts-exchange.com/Miscellaneous/Q_20780127.html (B> > (B> > Jason (B> > (B> > -- (B> > [EMAIL PROTECTED] mailing list (B> (B> sorry its www.techtv.com/thescreensavers (B (Bhttp://www.recover4all.com/ (B (B-- (BChris (B[EMAIL PROTECTED] (B (BScience is an atempt to investegate the mirical of life. (B (B The Martian Chronicles (B (B (B-- (B[EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 09:16 am, Jason Stubbs wrote: (B> On Sunday 02 November 2003 23:29, Jason Stubbs wrote: (B> > On Sunday 02 November 2003 22:54, Jason Stubbs wrote: (B> > > On Sunday 02 November 2003 21:20, Redeeman wrote: (B> > > > something happend, and i lost all files in a dir, i think i know what (B> > > > happend: (B> > > > i had made a link to the directory in a dir, so that i could share it (B> > > > on ftp, but when i removed the link, the dirs content got deleted (B> > > > too, its around 12gb og zip archives, and windows executables. (B> > > > i have NOT wrote to the disk since, in hope it can get recovered, i (B> > > > had a situation before: (B> > > > (B> > > > i had deleted some files in windows though, and i tried ontracks (B> > > > tool, it found files, but with the name b0rked, but runtimes software (B> > > > found with the correct name, this time i tried ontracks and the name (B> > > > was borked again, but runtimes didnt find anything, not even the (B> > > > files on the dir beyond, so i guess runtimes tool is capable of doing (B> > > > it, but maybe some stuff is needed in order to do it. (B> > > > (B> > > > some of you know how i might be able to recover? maybe its best with (B> > > > a linux tool? the filesystem is fat32 (B> > > (B> > > Your best bet would be to not touch it at all. There's a few tools on (B> > > linux that'll allow you to edit at the block level. Read up on them and (B> > > use them to look at the filesystem. At the same time search around for (B> > > information on the structure of the fat32 filesystem. Learn it while (B> > > looking at a live filesystem at the block level and then when you're (B> > > confident that you know what you are doing, you can attempt (B> > > restoration. If it doesn't work, then you know you can change it back (B> > > and start over. (B> > > (B> > > Personally, I don't know much about the FAT(32) file-system. The only (B> > > filesystem I was ever 100% familiar with was BAM (used on the C-64!) (B> > > but what I do know of FAT16 is that files are marked as deleted by (B> > > replacing the first character of the filename in the directory table (B> > > and then marking the occupying blocks as free in the allocation table. (B> > > I don't know what the implications are for the long-file-names aspect. (B> > > Once the directory entries are restored, doing a regular Windows (B> > > scandisk should pick up that the occupying blocks are marked as (B> > > unallocated and mark them as allocated in the allocation table. (B> > (B> > A further thought... don't touch the disk with Windows until you've got (B> > the data of it. When you try accessing it use "mount -t vfat -o ro" under (B> > Linux to ensure that the partition is not touched. (B> > (B> > Also, a very good description of the FAT12/16/32 filesystems can be found (B> > here: (B> > http://home.freeuk.net/foxy2k/disk/disk1.htm (B> (B> Forget all that I've said. Unless you've got a _lot_ of time, you have to (B> reconstruct which clusters belong to which file and in what order if doing (B> it manually. I'd like to know how the undelete programs successfully (?) (B> figure that! Anyway, I found this Q&A with several links (and links to (B> links) that should find you something that will work. If you have the space (B> to spare, maybe you should use dd from linux to back up the raw partition (B> first? Anyway, check here: (B> (B> http://beta.experts-exchange.com/Miscellaneous/Q_20780127.html (B> (B> Jason (B> (B> -- (B> [EMAIL PROTECTED] mailing list (B (Bsorry its www.techtv.com/thescreensavers (B-- (BChris (B[EMAIL PROTECTED] (B (BScience is an atempt to investegate the mirical of life. (B (B The Martian Chronicles (B (B (B-- (B[EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 09:16 am, Jason Stubbs wrote: (B> On Sunday 02 November 2003 23:29, Jason Stubbs wrote: (B> > On Sunday 02 November 2003 22:54, Jason Stubbs wrote: (B> > > On Sunday 02 November 2003 21:20, Redeeman wrote: (B> > > > something happend, and i lost all files in a dir, i think i know what (B> > > > happend: (B> > > > i had made a link to the directory in a dir, so that i could share it (B> > > > on ftp, but when i removed the link, the dirs content got deleted (B> > > > too, its around 12gb og zip archives, and windows executables. (B> > > > i have NOT wrote to the disk since, in hope it can get recovered, i (B> > > > had a situation before: (B> > > > (B> > > > i had deleted some files in windows though, and i tried ontracks (B> > > > tool, it found files, but with the name b0rked, but runtimes software (B> > > > found with the correct name, this time i tried ontracks and the name (B> > > > was borked again, but runtimes didnt find anything, not even the (B> > > > files on the dir beyond, so i guess runtimes tool is capable of doing (B> > > > it, but maybe some stuff is needed in order to do it. (B> > > > (B> > > > some of you know how i might be able to recover? maybe its best with (B> > > > a linux tool? the filesystem is fat32 (B> > > (B> > > Your best bet would be to not touch it at all. There's a few tools on (B> > > linux that'll allow you to edit at the block level. Read up on them and (B> > > use them to look at the filesystem. At the same time search around for (B> > > information on the structure of the fat32 filesystem. Learn it while (B> > > looking at a live filesystem at the block level and then when you're (B> > > confident that you know what you are doing, you can attempt (B> > > restoration. If it doesn't work, then you know you can change it back (B> > > and start over. (B> > > (B> > > Personally, I don't know much about the FAT(32) file-system. The only (B> > > filesystem I was ever 100% familiar with was BAM (used on the C-64!) (B> > > but what I do know of FAT16 is that files are marked as deleted by (B> > > replacing the first character of the filename in the directory table (B> > > and then marking the occupying blocks as free in the allocation table. (B> > > I don't know what the implications are for the long-file-names aspect. (B> > > Once the directory entries are restored, doing a regular Windows (B> > > scandisk should pick up that the occupying blocks are marked as (B> > > unallocated and mark them as allocated in the allocation table. (B> > (B> > A further thought... don't touch the disk with Windows until you've got (B> > the data of it. When you try accessing it use "mount -t vfat -o ro" under (B> > Linux to ensure that the partition is not touched. (B> > (B> > Also, a very good description of the FAT12/16/32 filesystems can be found (B> > here: (B> > http://home.freeuk.net/foxy2k/disk/disk1.htm (B> (B> Forget all that I've said. Unless you've got a _lot_ of time, you have to (B> reconstruct which clusters belong to which file and in what order if doing (B> it manually. I'd like to know how the undelete programs successfully (?) (B> figure that! Anyway, I found this Q&A with several links (and links to (B> links) that should find you something that will work. If you have the space (B> to spare, maybe you should use dd from linux to back up the raw partition (B> first? Anyway, check here: (B> (B> http://beta.experts-exchange.com/Miscellaneous/Q_20780127.html (B> (B> Jason (B> (B> -- (B> [EMAIL PROTECTED] mailing list (B (Babout three weeks ago someone called in on the screensavers with the same (Bproblem and told him about a few programs go throught their archives. (B (Bhope this helps. (Bhttp://www.thescreensavers.com (B-- (BChris (B[EMAIL PROTECTED] (B (BScience is an atempt to investegate the mirical of life. (B (B The Martian Chronicles (B (B (B-- (B[EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 23:29, Jason Stubbs wrote: (B> On Sunday 02 November 2003 22:54, Jason Stubbs wrote: (B> > On Sunday 02 November 2003 21:20, Redeeman wrote: (B> > > something happend, and i lost all files in a dir, i think i know what (B> > > happend: (B> > > i had made a link to the directory in a dir, so that i could share it (B> > > on ftp, but when i removed the link, the dirs content got deleted too, (B> > > its around 12gb og zip archives, and windows executables. (B> > > i have NOT wrote to the disk since, in hope it can get recovered, i had (B> > > a situation before: (B> > > (B> > > i had deleted some files in windows though, and i tried ontracks tool, (B> > > it found files, but with the name b0rked, but runtimes software found (B> > > with the correct name, this time i tried ontracks and the name was (B> > > borked again, but runtimes didnt find anything, not even the files on (B> > > the dir beyond, so i guess runtimes tool is capable of doing it, but (B> > > maybe some stuff is needed in order to do it. (B> > > (B> > > some of you know how i might be able to recover? maybe its best with a (B> > > linux tool? the filesystem is fat32 (B> > (B> > Your best bet would be to not touch it at all. There's a few tools on (B> > linux that'll allow you to edit at the block level. Read up on them and (B> > use them to look at the filesystem. At the same time search around for (B> > information on the structure of the fat32 filesystem. Learn it while (B> > looking at a live filesystem at the block level and then when you're (B> > confident that you know what you are doing, you can attempt restoration. (B> > If it doesn't work, then you know you can change it back and start over. (B> > (B> > Personally, I don't know much about the FAT(32) file-system. The only (B> > filesystem I was ever 100% familiar with was BAM (used on the C-64!) but (B> > what I do know of FAT16 is that files are marked as deleted by replacing (B> > the first character of the filename in the directory table and then (B> > marking the occupying blocks as free in the allocation table. I don't (B> > know what the implications are for the long-file-names aspect. Once the (B> > directory entries are restored, doing a regular Windows scandisk should (B> > pick up that the occupying blocks are marked as unallocated and mark them (B> > as allocated in the allocation table. (B> (B> A further thought... don't touch the disk with Windows until you've got the (B> data of it. When you try accessing it use "mount -t vfat -o ro" under Linux (B> to ensure that the partition is not touched. (B> (B> Also, a very good description of the FAT12/16/32 filesystems can be found (B> here: (B> http://home.freeuk.net/foxy2k/disk/disk1.htm (B (BForget all that I've said. Unless you've got a _lot_ of time, you have to (Breconstruct which clusters belong to which file and in what order if doing it (Bmanually. I'd like to know how the undelete programs successfully (?) figure (Bthat! Anyway, I found this Q&A with several links (and links to links) that (Bshould find you something that will work. If you have the space to spare, (Bmaybe you should use dd from linux to back up the raw partition first? (BAnyway, check here: (B (Bhttp://beta.experts-exchange.com/Miscellaneous/Q_20780127.html (B (BJason (B (B-- (B[EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 22:54, Jason Stubbs wrote: (B> On Sunday 02 November 2003 21:20, Redeeman wrote: (B> > something happend, and i lost all files in a dir, i think i know what (B> > happend: (B> > i had made a link to the directory in a dir, so that i could share it on (B> > ftp, but when i removed the link, the dirs content got deleted too, its (B> > around 12gb og zip archives, and windows executables. (B> > i have NOT wrote to the disk since, in hope it can get recovered, i had (B> > a situation before: (B> > (B> > i had deleted some files in windows though, and i tried ontracks tool, (B> > it found files, but with the name b0rked, but runtimes software found (B> > with the correct name, this time i tried ontracks and the name was (B> > borked again, but runtimes didnt find anything, not even the files on (B> > the dir beyond, so i guess runtimes tool is capable of doing it, but (B> > maybe some stuff is needed in order to do it. (B> > (B> > some of you know how i might be able to recover? maybe its best with a (B> > linux tool? the filesystem is fat32 (B> (B> Your best bet would be to not touch it at all. There's a few tools on linux (B> that'll allow you to edit at the block level. Read up on them and use them (B> to look at the filesystem. At the same time search around for information (B> on the structure of the fat32 filesystem. Learn it while looking at a live (B> filesystem at the block level and then when you're confident that you know (B> what you are doing, you can attempt restoration. If it doesn't work, then (B> you know you can change it back and start over. (B> (B> Personally, I don't know much about the FAT(32) file-system. The only (B> filesystem I was ever 100% familiar with was BAM (used on the C-64!) but (B> what I do know of FAT16 is that files are marked as deleted by replacing (B> the first character of the filename in the directory table and then marking (B> the occupying blocks as free in the allocation table. I don't know what the (B> implications are for the long-file-names aspect. Once the directory entries (B> are restored, doing a regular Windows scandisk should pick up that the (B> occupying blocks are marked as unallocated and mark them as allocated in (B> the allocation table. (B (BA further thought... don't touch the disk with Windows until you've got the (Bdata of it. When you try accessing it use "mount -t vfat -o ro" under Linux (Bto ensure that the partition is not touched. (B (BAlso, a very good description of the FAT12/16/32 filesystems can be found (Bhere: (Bhttp://home.freeuk.net/foxy2k/disk/disk1.htm (B (BJason (B (B-- (B[EMAIL PROTECTED] mailing list
Re: [gentoo-user] Data Recovery NEEDED, very important
On Sunday 02 November 2003 21:20, Redeeman wrote: (B> something happend, and i lost all files in a dir, i think i know what (B> happend: (B> i had made a link to the directory in a dir, so that i could share it on (B> ftp, but when i removed the link, the dirs content got deleted too, its (B> around 12gb og zip archives, and windows executables. (B> i have NOT wrote to the disk since, in hope it can get recovered, i had (B> a situation before: (B> (B> i had deleted some files in windows though, and i tried ontracks tool, (B> it found files, but with the name b0rked, but runtimes software found (B> with the correct name, this time i tried ontracks and the name was (B> borked again, but runtimes didnt find anything, not even the files on (B> the dir beyond, so i guess runtimes tool is capable of doing it, but (B> maybe some stuff is needed in order to do it. (B> (B> some of you know how i might be able to recover? maybe its best with a (B> linux tool? the filesystem is fat32 (B (BYour best bet would be to not touch it at all. There's a few tools on linux (Bthat'll allow you to edit at the block level. Read up on them and use them to (Blook at the filesystem. At the same time search around for information on the (Bstructure of the fat32 filesystem. Learn it while looking at a live (Bfilesystem at the block level and then when you're confident that you know (Bwhat you are doing, you can attempt restoration. If it doesn't work, then you (Bknow you can change it back and start over. (B (BPersonally, I don't know much about the FAT(32) file-system. The only (Bfilesystem I was ever 100% familiar with was BAM (used on the C-64!) but what (BI do know of FAT16 is that files are marked as deleted by replacing the first (Bcharacter of the filename in the directory table and then marking the (Boccupying blocks as free in the allocation table. I don't know what the (Bimplications are for the long-file-names aspect. Once the directory entries (Bare restored, doing a regular Windows scandisk should pick up that the (Boccupying blocks are marked as unallocated and mark them as allocated in the (Ballocation table. (B (BGood Luck (with a capital L!) (B (BJason (B (B-- (B[EMAIL PROTECTED] mailing list
[gentoo-user] Data Recovery NEEDED, very important
something happend, and i lost all files in a dir, i think i know what happend: i had made a link to the directory in a dir, so that i could share it on ftp, but when i removed the link, the dirs content got deleted too, its around 12gb og zip archives, and windows executables. i have NOT wrote to the disk since, in hope it can get recovered, i had a situation before: i had deleted some files in windows though, and i tried ontracks tool, it found files, but with the name b0rked, but runtimes software found with the correct name, this time i tried ontracks and the name was borked again, but runtimes didnt find anything, not even the files on the dir beyond, so i guess runtimes tool is capable of doing it, but maybe some stuff is needed in order to do it. some of you know how i might be able to recover? maybe its best with a linux tool? the filesystem is fat32 PLEASE PLEASE PLEASE help i will apreciate ANYTHING, and i am willing to pay if some of you can help -- Regards, Redeeman () ascii ribbon campaign - against html e-mail /\- against microsoft attachments -- [EMAIL PROTECTED] mailing list
