any FAT32 undelete gurus?

  • Thread starter Thread starter pedro1492
  • Start date Start date
P

pedro1492

I have recorded files from a set-top box to a USB hard disk. I accidentally
pressed delete all instead of delete one. I immediately removed the USB drive and
plugged it in to a Windows PC and ran an undelete program called Recuva. I have
used this successfully before. After it scanned the disk, I selected only the
files marked green, which are not overwritten. I restored them to a different
drive. However only about a third are good. Seems to be lots of crosslinking.
For example, if I try to watch those recovered files, they suddenly jump from
one TV show to another, or simply freeze up. The other thing was that
Recuva showed a lot of filenames which were 2 or 3 filenames concatenated.
The really weird thing is that the STB creates filenames of the form
channel-date-time
I had renamed most of them to something more meaningful. However Recuva
was showing the old channel-date-time filenames in most cases. This is for
the those considered recoverable as well as unrecoverable.
The disk is formatted FAT32. The STB seems to use linux, because if you
navigate up the folders, you finally see "/dev/sdb"
So I wonder if the STB is not writing proper FAT32.

I know I could send the drive to a data recovery specialist, but the
recorded content is not worth it for the fees they charge.
 
I have recorded files from a set-top box to a USB hard disk. I accidentally
pressed delete all instead of delete one. I immediately removed the USB drive and
plugged it in to a Windows PC and ran an undelete program called Recuva. I have
used this successfully before. After it scanned the disk, I selected only the
files marked green, which are not overwritten. I restored them to a different
drive. However only about a third are good. Seems to be lots of crosslinking.
For example, if I try to watch those recovered files, they suddenly jump from
one TV show to another, or simply freeze up. The other thing was that
Recuva showed a lot of filenames which were 2 or 3 filenames concatenated.
The really weird thing is that the STB creates filenames of the form
channel-date-time
I had renamed most of them to something more meaningful. However Recuva
was showing the old channel-date-time filenames in most cases. This is for
the those considered recoverable as well as unrecoverable.
The disk is formatted FAT32. The STB seems to use linux, because if you
navigate up the folders, you finally see "/dev/sdb"
So I wonder if the STB is not writing proper FAT32.

I know I could send the drive to a data recovery specialist, but the
recorded content is not worth it for the fees they charge.
Click to expand...

If you ran Chkdsk on the recovered hard disk, then it should've
recovered most of those properly. Yes, that's right, simple old chkdsk
is the way to go.

Yousuf Khan
 
I have recorded files from a set-top box to a USB hard disk. I
accidentally
pressed delete all instead of delete one. I immediately removed the USB
drive and plugged it in to a Windows PC and ran an undelete program
called Recuva. I have used this successfully before.
Click to expand...

With a drive written by the set top box tho ?
After it scanned the disk, I selected only the files marked green,
which are not overwritten. I restored them to a different drive.
However only about a third are good. Seems to be lots of
crosslinking. For example, if I try to watch those recovered
files, they suddenly jump from one TV show to another,
Click to expand...

That's because the files were fragmented before they were
deleted. There is nothing any undeleter can do about that.
or simply freeze up.
Click to expand...

Because the file has ended up with some no video capture
data embedded in it because of the fragmentation.
The other thing was that Recuva showed a lot of
filenames which were 2 or 3 filenames concatenated.
Click to expand...

That's certainly a worry.
The really weird thing is that the STB creates filenames
of the form channel-date-time I had renamed most of
them to something more meaningful.
Click to expand...

Presumably you mean before you accidentally deleted them all.
However Recuva was showing the old channel-
date-time filenames in most cases.
Click to expand...

That's because it renamed them by creating a new
file name entry and marking the old one as deleted.
So when Recuva undeletes the files, it sees those entrys
that were the result of a rename as deleted files.
This is for the those considered
recoverable as well as unrecoverable.
Click to expand...

It normally decides something is recoverable because
the file name entry points to blocks of used clusters.
The disk is formatted FAT32. The STB seems to use linux,
because if you navigate up the folders, you finally see "/dev/sdb"
So I wonder if the STB is not writing proper FAT32.
Click to expand...

More likely it just does some stuff differently like renaming.
I know I could send the drive to a data recovery specialist, but
the recorded content is not worth it for the fees they charge.
Click to expand...

You may be able to find something that recovers by
analysing the clusters for what are chunks of video
capture files and lets you deal with the chunks it
finds manually, so you can join up the obvious
bits from the recorded content you can see when
you play the chunks.
 
I have recorded files from a set-top box to a USB hard disk. I accidentally
pressed delete all instead of delete one. I immediately removed the USB drive and
plugged it in to a Windows PC and ran an undelete program called Recuva. I have
used this successfully before. After it scanned the disk, I selected only the
files marked green, which are not overwritten. I restored them to a different
drive. However only about a third are good. Seems to be lots of crosslinking.
For example, if I try to watch those recovered files, they suddenly jump from
one TV show to another, or simply freeze up. The other thing was that
Recuva showed a lot of filenames which were 2 or 3 filenames concatenated.
The really weird thing is that the STB creates filenames of the form
channel-date-time
I had renamed most of them to something more meaningful. However Recuva
was showing the old channel-date-time filenames in most cases. This is for
the those considered recoverable as well as unrecoverable.
The disk is formatted FAT32. The STB seems to use linux, because if you
navigate up the folders, you finally see "/dev/sdb"
So I wonder if the STB is not writing proper FAT32.

I know I could send the drive to a data recovery specialist, but the
recorded content is not worth it for the fees they charge.
Click to expand...

You probably wrecked the file system when you hurriedly
removed the USB, Recuva will recover deleted files AS LONG AS YOU HAVE
NOT RUN ANY FORM OF FILE CHECKER like chkdsk on the drive, and as long
as you did not remove the drive while the tables were being updated.
That should not have affected the media files as much as the indexes
though. Next time remember to switch off before removing the USB.
I'm not sure if USB FAT32 keeps a second copy of the FAT, but
you would be doing petty risky stuff trying to recover it. It is
possible in hard drives with a dd command, which I can't remember
offhand.
Before you do any more damage, download USBit
http://www.alexpage.de/usb-image-tool/
and make a copy of the drive, in "Device mode". If you fsck
up, you can always re-image the USB and start over.
[]'s
 
Back
Top