Is it possible to extract a file from FAT16 image by it's name/extension???

hhanff · 10-16-2008, 09:20 AM

Hello!

I have a problem. There is probably a file called Test.raw on a FAT16 image which was sent to me. I hope it was not overwritten.
I found several linux-tools that can recover files by their header/footer information.
My question is: Is it possible to recover a file only by it's name/extension?

Greetings,

Hendrik

whansard · 10-16-2008, 09:41 AM

mount the fat16 image in loopback mode.
mount -o loop <image.name> <mountpoint>
then run find on the mountpoint where yo umounted the image

find /mountpoint -name "image.raw" -print

hhanff · 10-16-2008, 10:29 AM

Quote:

Originally Posted by whansard

mount the fat16 image in loopback mode.
mount -o loop <image.name> <mountpoint>
then run find on the mountpoint where yo umounted the image

find /mountpoint -name "image.raw" -print

What I did was
grep -oba Test linux.img
... and then cut the area with
dd if=linux.img of=part bs=1 count=1024 skip=24359
... but I could not find Test.raw... only Test or RAW.
I will try your method tomorrow. Thanks in advance.

Also I wonder what about fragmentation.... usually files are not written to the HDD in one big block, but are distributed over several clusters...

Hendrik

hhanff · 10-17-2008, 01:23 AM

Quote:

Originally Posted by whansard

mount the fat16 image in loopback mode.
mount -o loop <image.name> <mountpoint>
then run find on the mountpoint where yo umounted the image

find /mountpoint -name "image.raw" -print

Thanks for your help.
It finds the existing loop/CPT/Test.raw file. But there should be some other Test.raw files on the image which were deleted... any other ideas???