On Fri, Nov 22, 2002 at 03:18:51AM +0000, Pigeon wrote:
> On Thu, 21 Nov 2002 16:01:31 -0800, Craig Dickson <[EMAIL PROTECTED]>
> wrote:
>
> >Osamu Aoki wrote:
> >
> >> I used to undelete DOS file by changing first byte of filename at the
> >> directory entry list from 0x5F or something to ordinary character.
> >>
> >> Then you get back DOD file. (Floppy and not in subdirectory, but it
> >> should wok similarly...)
> >
> >That isn't close to being sufficient. It restores the directory entry,
> >but it doesn't reallocate the file's sector clusters, nor does it
> >re-establish the linkage from one cluster to the next. If the file is
> >more than one cluster long, you have no way of knowing where the rest of
> >it is. With a sector editor, you may be able to find it, particularly if
> >you're lucky and the file wasn't fragmented, or if you know what the
> >file's contents look like. (Good luck if it's some binary format without
> >much readable text in it.)
> >
> >Craig
>
> The magic character is E5. (not E6) The deleted directory entry still
> stores the starting cluster number, and looking through the FAT for
> clusters with entry 0 starting at that cluster gives you some chance,
Yah, I think at one point I wrote short special HEX dump utility of
clusters :0 (You know 12 bit = 8 X 1.5 table)
By the way, there is easy way. Use "undelete" command to recover these
lost files.
> though I admit it's a pain. Bad luck that it's a gzip but you still
> stand a chance if there weren't any other gzips using adjacent parts
> of the disk that have also been deleted. Look at some known gzips in
> hex first and get a feel for what they look like (somewhere between
> "code" and "random").
I have not done it lately but 8086 code usually have PQRTS in ascii
dump. (POP/PUSH from/to stack things).
--
~\^o^/~~~ ~\^.^/~~~ ~\^*^/~~~ ~\^_^/~~~ ~\^+^/~~~ ~\^:^/~~~ ~\^v^/~~~ +++++
Osamu Aoki <[EMAIL PROTECTED]> Cupertino CA USA, GPG-key: A8061F32
.''`. Debian Reference: post-installation user's guide for non-developers
: :' : http://qref.sf.net and http://people.debian.org/~osamu
`. `' "Our Priorities are Our Users and Free Software" --- Social Contract
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
