views:

1052

answers:

2

I'm trying to find some lost .jpg pictures. Here's a .bat file to setup a simplified version of my situation

md TestSetup
cd TestSetup
md a
cd a
echo "Can we find this later?" > a.abc
del a.abc
cd..
rd a

What code would be needed to open the text file again? I'm actually looking for .jpeg files that were treated in a similar manner

More details: I'm trying to recover picture files from a previous one-touch backup where the directories and files have been deleted and everything was saved in the backup with a single character name and every file has the same 3 letter extension. There is a current backup but they need to view the previous deleted ones (or at least the .jpg files).

Here's how I was trying to approach it: C# code

+5  A: 

To the best of my knowledge, most file recovery tools actually read the low-level filesystem format on the disk and try to piece together deleted files. This works because, at least in FAT, a deleted file still resides in the sector specifying the directory (just with a different first character to identify it as "deleted"). New files may overwrite these deleted entries and therefore make the file unrecoverable. That's just a little bit of theory.

There is a current backup but they need to view the previous deleted ones (or at least the .jpg files).

Unless there's a backup for that file at the time that you want to restore from, I believe you're going to have a hard time getting that file without resorting to a low-level filesystem read. And even then, you may be out of luck if enough revisions have been made (or it's not a trivial filesystem like FAT).

Matthew Iselin
It is on a FAT32 drive, and I've gone in with a hex editor and verified that there are a number of deleted directories and files still present. With several hundred one letter name (deleted) directory entries available I figure I'm going to have to iterate through restoring each one and then checking each deleted directory and file entry in each one and check the first 4 bytes of each file to see if it's a valid .jpg.
Fred
Right, and that tedious process is what most file recovery software does for you. I'd highly suggest writing a code solution (a simple FAT32 driver can be whipped up in a couple of hours, in case you don't already know), as doing it by hand with a hex editor could be far more painful.
Matthew Iselin
A: 

I've used RecoverMyFiles to get back a bunch of stuff from 2 separate hard drive crashes over the years. It may prove useful.

Nader Shirazie