[ltp] Copying Files

[Chris Meidinger]

All,

>What disk recovery tools are available for working with corrupted FAT
>file systems now? I've used debugfs for ext2, but that's obviously
>pointless with FAT. Are there any at all for Linux?
>  
>
try fsck.vfat for one, that's pretty reasonable. If these are 
super-important-mega-bux files, then pick up a copy of kevin mandia's 
incident response book and learn how to follow the FAT-chains by hand. 
It's slow for recovering individual files, but if the files are 
important, worth it.

If the files are not mission-critical, look into Autopsy and The 
Coroners's Toolkit. These systems both have methods for reading fubared 
FAT-tables.

>Also, again Frank, how exactly did you corrupt the partition? What
>command did you run? How long did it run before you realized the
>mistake and stopped it?
>  
>
This is an important question!

>Hope this helps, I know what losing data feels like.
>  
>
My customer's don't know what it feels like, but i do.

>(Backups suck! :p)
>  
>
Because that's my position as well! Who needs backups*
*(my t42p died on friday, and i could use a backup really badly.)

Anyway, the advice about making a copy to work with and trying to 
recover on that is sound. Don't even think about trying to recover on 
the original.

Cheers, Chris