On Thu, 21 Nov 2002 16:01:31 -0800, Craig Dickson <[EMAIL PROTECTED]> wrote:
>Osamu Aoki wrote: > >> I used to undelete DOS file by changing first byte of filename at the >> directory entry list from 0x5F or something to ordinary character. >> >> Then you get back DOD file. (Floppy and not in subdirectory, but it >> should wok similarly...) > >That isn't close to being sufficient. It restores the directory entry, >but it doesn't reallocate the file's sector clusters, nor does it >re-establish the linkage from one cluster to the next. If the file is >more than one cluster long, you have no way of knowing where the rest of >it is. With a sector editor, you may be able to find it, particularly if >you're lucky and the file wasn't fragmented, or if you know what the >file's contents look like. (Good luck if it's some binary format without >much readable text in it.) > >Craig The magic character is E5. (not E6) The deleted directory entry still stores the starting cluster number, and looking through the FAT for clusters with entry 0 starting at that cluster gives you some chance, though I admit it's a pain. Bad luck that it's a gzip but you still stand a chance if there weren't any other gzips using adjacent parts of the disk that have also been deleted. Look at some known gzips in hex first and get a feel for what they look like (somewhere between "code" and "random"). Pigeon -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
