OT-File recovery

[Bruce McDonald]

Hello Rick

On 06-Apr-05, you wrote:

> Bruce McDonald wrote:
>> Hello Bruce
>> 
>> On 01-Apr-05, you wrote:
>> 
>> 
>>> Hello Everyone,
>> 
>> 
>>> Do any of you know of a good file recovery utility that works on FAT32
>>> filesystems?
>> 
>> 
>>> <sighs>  Yes, I _know_ I should have had a more recent backup of the
>>> system....
>> 
>> 
>>> Backstory: My wife uses Netscape 7.1 for her email and newsgroups. The
>>> first time she would run it after a fresh bootup it would ask which
>>> profile to use. There was only one profile, default. This has been
>>> vexing her for some time. Wednesday she was sick with a cold and
>>> suffering from a fever and when it asked for the profile.... in a fit of
>>> pique, she deleted the profile. To make matters worse, she had been
>>> planning on moving up to 7.2, which she did right after deleting the
>>> profile. So now there is a new "salt" file where the old one was and she
>>> has none of her email addresses or important email messages from the
>>> past year.
>> 
>> 
>>> I have looked at the drive with PC File Recovery and it did find a
>>> couple of emails, but I know it can't track the file past the first
>>> cluster it is on.
>>> I despair of recovering the information since the settings area has been
>>> written to after the file was deleted.
>> 
>> 
>>> Is there a program out there that can try and piece together the
>>> clusters? Or at least let me see the data on each cluster so I can
>>> recreate as much of the email file as possible?
>> 
>> 
>>> I could boot a linux cd on the computer and mount the drive under linux
>>> if there is a linux utility to fit the bill.
>> 
>> 
>> 
>> 
>>> Thank you in advance.


>> I hope this was not written off as an April fools joke since it had the
>> unfortunate luck of being written on the 1st. I am still hoping that
>> someone knows something that will help recover the files that were lost.
>> I have tried R-Studio recovery, and while it listed the directories and
>> some of the files; the true files were not there. It seems to have been
>> unable to follow the trail of data over the drive. Any suggestions?

> It depends on what happened to the filesystem between the time the files
> were deleted and the time you try to recover them.  When a file is
> deleted, what actually happens is that the directory entry for the file
> is actually marked as "unused" as are all of the bits of the disk used
> to make up the file.  When new data is written to the disk, the "unused"
> space is reused as needed.

> That means that if you delete files, then IMMEDIATELY try to recover
> them (before anything else gets to try to write to the disk), your odds
> of recovery are excellent.  If, however, something new gets written to
> the disk, whatever bits of the disk that were reused by the new file are
> unrecoverable for the old file.

Thank you for your response Rick.

Netscape had been asking what profile to use whenever it was started (there
was only the default setup on the machine) this annoyed my wife and she
deleted the default profile to see if that would stop the query. 
Unfortunatly, once the profile was deleted my wife decided that now was the
time to upgrade to netscape 7.2.   When she opened the upgraded mail and
newsreader she noticed that her addressbook was empty and there were no
mail accounts or newsgroups.

This leads me to believe that the files may be unrecoverable or only
partially recoverable.

> Now, as to FAT32 recoveries...there are tons of tools.  Norton
> Utilities is one of the best and it's fairly cheap ($50 or so).  If you
> want freeware, a google search for "file recovery" should net a whole
> bunch of stuff.

Oh dear,  I just shelled out $80 for R-Studio recovery, though it is
supposed to work across a network and with linux and NTFS filesystems. 
It found a  lot of the "junk" we have recently deleted.  It also found the
file names of the deleted email and newsgroup files from the profile data. 
Unfortunately, the recovered files were either empty or contained other
random data, plus sometimes a tidbit of similar data.  This has been bits
of email from my folder, which I don't mind so much that it was deleted.
Maybe I should get Norton Utiliies and give it a try too.  Yet, I don't know
if it would have any better luck since the 7.2 profile was written in the
same settings folder after the 7.1 profile was deleted.

I have been thinking of taking a hex editior to the drive and searching for
the data by hand.  I know what the netscape email and addressbook files
look like, so I could probably find any pieces of the files and rebuild
them.
Any thoughts on this?


Sincerely,
Bruce McDonald