[Sheflug] Lost files from a VFAT disk (Finagle's Law: the Proof!)

[James Wallbank <james [at] xxxxxxxxxxx>]

Hello All,

Very annoyingly, I've just deleted 32 Megabytes of images from a Compact
Flash disk. How could this happen? Surely you make backups, James?!

Yes, indeed. I copied the files from the CF media (using cp -a) and
saved them safely on the fileserver. Oh - I duplicated the files on my
laptop local drive, too - can't be too careful!

Then I removed the files from the CF disk.

rm -rf /mnt/removable_disk/*

I took two more photos on the now empty, but un-reformatted disk, then I
went to look at my lovely pictures.

Argh! All the pictures were correctly named, but were exactly 4096 bytes
long, filled with ^@ characters! (is that a null?) My second-generation
backup was equally uninformative.

Two questions:

(1) Any idea how the problem may have occurred in the first place? (I've
used cp -a over and over again to pull files off a supermounted vfat
device with no problems.)

(2) How can I recover the data? I have a complete image of the CF disk:

dd if=/dev/sda1 of=cf_disk_image bs=0124

I've tried the following:

losetup /dev/loop0 cf_disk_image
for i in seq(0 90); \
do dosfsck -u /DCIM/100NIKON/DSCN$(printf %04i $i).JPG /dev/loop0; \
done;

...but for each file I get the annoying message:

"Reclaimed 1 unused cluster (4096 bytes) \ Warning: did not undelete
file DSCN00NN.JPG \ Leaving file system unchanged."

Interestingly, if I accidentally spell the path name wrong (my favorite
is 100NIKO/) then I get the same error message - which leads me to
believe I may be completely mis-understanding the path name parameter.

As you'll now realise, the files I am hoping to recover were all in the
CF Disk inside a directory called DCIM/100NIKON/, and they were named
DSCN0001.JPG to DSCN0090.JPG. Unfortunately, when I took more pictures,
a new directory was created by the camera with the same name. I don't
know whether this makes recovery impossible or harder.

My one hope is that I misunderstand the syntax for dosfsck. Have you any
advice? Alternatively, can you suggest another methodology that might
help?

Oh, one more thing...

hexdump -C cf_disk_image | grep -a EExif

... gives cause for hope. EExif is part of the start of each JPEG file,
and exactly 90 of them turn up!

Thanks in advance for your help.

James
=====
-- 
James Wallbank
Access Space - 1 Sidney Street - Sheffield S1 4RG
T: +44 (0)114 2495522
F: +44 (0)114 2495533
W: http://access.lowtech.org
___________________________________________________________________

Sheffield Linux User's Group -
http://www.sheflug.co.uk/mailfaq.html

  GNU the choice of a complete generation.