[CLUG] Forgot to Unmount :-(

[Eoin Kelly]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Thu, Oct 23, 2003 at 09:57:38AM +0100, A. H. wrote:
>It appears that all this larky was done by the windows chkdisk when
>I restarted into win2000.
Possibliity #1:
    Recover chk files:
    http://www.ericphelps.com/uncheck/


Possibiltiy #2:
    windows chkdsk help says:
         Windows saves each lost chain in the root directory as a file with a
         name in the format Filennnn.chk. When chkdsk finishes, you can check
         these files to see if they contain any data you need.
    but remains silent on how you might do this.

    I don't know enough about the structure of fat32 but i think you need to find
    out what a "chain" is and how it relates to files/folders. At least you were
    using fat32, I believe you would be rightly fscked if it was NTFS. You may find
    the coroners toolkit [0] and the related tctutils of use - it's been a while since
    I played with them but I seem to remember one of the tools being able to
    recognise deleted images (jpeg,gif) in a disk dump - maybe this could be
    trained to find mp3s? I wouldn't be too hopeful about matching ID3 tags because
    in my experience they can appear either at the end or the beginning of the mp3
    (and can contain both V1 and V2 format tags) - i'm not saying it's
    impossible, just not easy. I think your best bet is to take this
    "chains" idea and find a description of fat32 and see what you need to
    do to go from chains to a filesystem again
    (http://www.pjrc.com/tech/8051/ide/fat32.html seems good and he mentions
    "cluster chains" which sounds like what you have). Let us know how you
    get on.

Hopefully #1 does the business for you. Let us know how you get on
either way.



My EUR 0.02
/Eoin/

>
>I had a better look at the .chk files last night. However they don't
>appear to be the adverage size of mp3's but rather the size of folders
>as I had thought.
I don't think they are either (see above)

[0] http://www.porcupine.org/forensics/tct.html

- -- 
Eoin Kelly                           | Dept. Of Applied Psychology
Technical Advisor (COPINE Project)   | University College Cork
http://www.copine.ie                 | Ireland
PGP Info:  http://joy.ucc.ie/pgp/
Key Fingerprint = EF0D B2E7 CBB9 32BB 7CFA  F226 BC38 89C2 335D C7CC
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Public Key available at http://joy.ucc.ie/pgp/

iD8DBQE/mQ2avDiJwjNdx8wRAsvCAKC61FhZ/oRn+pGq6oAY0o1n45DNcACfafbP
RF+fwF4IDQoUGwvvogmDIw0=
=g0Qd
-----END PGP SIGNATURE-----