Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!


Click here to return to the 'DD is your friend' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
DD is your friend
Authored by: mschiller on Jan 16, '04 01:25:43PM

Most Camera's use the FAT or FAT32 filesystem on the CF card. The interesting thing about both of those is that deleting a file, does not destroy the data. Indeed all it really does is changes the directory information:

say mypict.jpg turns into $ypict.jpg
($ represents an illegal character, I can't remember off hand which one is used). The point is that all files with that character as the first character of the Filename are not shown in a directory and their actual data storage area is not reserved. Typically the Data is still on the disk and either some creative hacking with a hexeditor or a Fat File system undelete utility will solve your woes. But since that physical space on the disk is not reserved, it's critical that you do this ASAP after realizing you accidentally deleted something you wanted!

If this happened to me, and I really cared about the pictures I lost, I'd immediately do this in the terminal:

mount
(find the device info for your CF reader)
umount /dev/whatever
dd if=/dev/whatever of=$HOME/mybad.img bs=512

(of course first I'd have to clear out enough space on the powerbook harddrive!!! Because that dd command is going to create an byte for byte image of the CF card)


Once created I could then continue to use the CF card on vacation. When I had access to recovery tools (I know tools exist on Linux, old MSDOS, I'm sure something is out there that is free for MacOSX too) The image file can be loop back mounted and the recovery tools ran to look at the FAT directory structure find the deleted files and recover them.. Or if you need to move it to a DOS machine for example, you could write it back to the CF card with the following command scheme:
mount (get device name)
umount /dev/whatever
dd if=$HOME/mybad.img of=/dev/whatever bs=512


-- Matthew



[ Reply to This | # ]
DD is your friend
Authored by: diamondsw on Jan 16, '04 01:48:49PM

Well, unless you use "Secure Delete" or somesuch, the file data is left behind on any filesystem, including HFS+. The directory information is removed (so you lose access to the file) and space is marked as free, but the data itself is not touched.



[ Reply to This | # ]