OESF Portables Forum

General Forums => General Discussion => Topic started by: raptorspike on May 31, 2006, 12:26:59 pm

Title: Recovering Deleted Files
Post by: raptorspike on May 31, 2006, 12:26:59 pm
Does anyone know if there is someway to recover deleted files from the zaurus OS?
Title: Recovering Deleted Files
Post by: jfv on May 31, 2006, 02:53:49 pm
Quote
Does anyone know if there is someway to recover deleted files from the zaurus OS?
[div align=\"right\"][a href=\"index.php?act=findpost&pid=129154\"][{POST_SNAPBACK}][/a][/div]

Maybe. How about you tell us which model, ROM, what kind of file, which kind of media (flash, RAM, HD,...)?

Felipe
Title: Recovering Deleted Files
Post by: Cresho on May 31, 2006, 03:01:31 pm
its easy and there is a way but you need to tell us my boy
Title: Recovering Deleted Files
Post by: bluedevils on May 31, 2006, 04:33:48 pm
it's a 5500, but he doesn't say what rom he's using.  It sounds like a sharp rom or variant.
Title: Recovering Deleted Files
Post by: Snappy on May 31, 2006, 08:55:44 pm
how about one running Cacko 1.23 on C1000? File was on CF card.
Title: Recovering Deleted Files
Post by: jfv on May 31, 2006, 10:56:30 pm
You might want to check this website (http://www.cs.washington.edu/homes/oskin/saveimg.html). He explains how to recover jpegs from a CF card. The first part, i.e. using dd to copy the raw contents of the card to a file, should apply regardless of the kind of file you are looking for.  Now, depending on what you want you may have to open the copy of the card in a hex editor.

Felipe
Title: Recovering Deleted Files
Post by: daniel3000 on June 01, 2006, 04:21:33 am
Quote
You might want to check this website (http://www.cs.washington.edu/homes/oskin/saveimg.html). He explains how to recover jpegs from a CF card. The first part, i.e. using dd to copy the raw contents of the card to a file, should apply regardless of the kind of file you are looking for.  Now, depending on what you want you may have to open the copy of the card in a hex editor.

Felipe
[div align=\"right\"][a href=\"index.php?act=findpost&pid=129234\"][{POST_SNAPBACK}][/a][/div]

I have used that "saveimg" program before.
It basically looks for JPEG headers inside the card image (or on the card) and uses them to seperate ranges. These seperated ranges are then converted into JPG files.

Works nicely for cards which had JPEG files on them. If other files were stored on the card it will work, too, but only for the JPEG files. The other files will not be recovered but they will raher be appended to the JPEG files, depending on the file structure on the disk. i.e. the JPEG files will be larger than before. This does not disturb most JPEG viewers, as they simply ignore the non-JPEG stuff at the end of the file.

I think this program could be easily converted to recognize other kinds of file headers. So if the header of the lost file is known, a modified version of that program may be able to find and extract it, probably with garbage at the end.

A problem for this program, however, are probably fragmented files, so take care and only work on an image (_complete_ copy) of the card.

daniel
Title: Recovering Deleted Files
Post by: poplav on June 01, 2006, 11:42:36 pm
If you have perl installed, or have access to a machine with perl, or if you want to install perl, you can try The Coroners Toolkit, AKA TCT.
Title: Recovering Deleted Files
Post by: jfv on June 02, 2006, 11:57:29 am
I also recall reading somewhere that Midnight Commander (a file browser) has a recover utility but I never tried using it.

Felipe
Title: Recovering Deleted Files
Post by: speculatrix on June 05, 2006, 03:32:47 pm
if it's a CF card formatted FAT file system, there are lots of undelete programs for dos/windows... put card in a memory card reader into windows box. find program on www.tucows.com ?
Title: Recovering Deleted Files
Post by: Jon_J on June 05, 2006, 04:07:26 pm
Look for "encase"
I have a version that works on windows 98
It won't work on XP, but if I plug my card reader into my 98 machine, it would work there.
It's a prog. that detectives use to find deleted files on a HDD