4

I'm trying to find some lost .jpg pictures. Here's a .bat file to setup a simplified version of my situation

md TestSetup
cd TestSetup
md a
cd a
echo "Can we find this later?" > a.abc
del a.abc
cd..
rd a

What code would be needed to open the text file again? I'm actually looking for .jpeg files that were treated in a similar manner

More details: I'm trying to recover picture files from a previous one-touch backup where the directories and files have been deleted and everything was saved in the backup with a single character name and every file has the same 3 letter extension. There is a current backup but they need to view the previous deleted ones (or at least the .jpg files).

Here's how I was trying to approach it: C# code

Community
  • 1
  • 1
Fred
  • 2,713
  • 3
  • 27
  • 30
  • When you run your bat file, do the deleted files end up in the recycle bin? – MusiGenesis Aug 29 '09 at 22:35
  • 1
    Is it imperative that you write this app yourself? There are free deleted file recovery utilities out there that do exactly what you'e after. – Paul Sasik Aug 29 '09 at 22:53
  • MusiGenesis: No, when a batch file deletes it that way, it does what Matthew mentions, replacing the first character of the file name in the directory entry with 00h. – Fred Aug 30 '09 at 03:53
  • psasik: I'd love to find a cheap or free utility that would do this. Though I refuse to pay for crippleware especially when I don't know if it's going to work. The single letter directory and file names and changed file extensions makes it a lot harder than it should be. – Fred Aug 30 '09 at 03:55

1 Answers1

8

To the best of my knowledge, most file recovery tools actually read the low-level filesystem format on the disk and try to piece together deleted files. This works because, at least in FAT, a deleted file still resides in the sector specifying the directory (just with a different first character to identify it as "deleted"). New files may overwrite these deleted entries and therefore make the file unrecoverable. That's just a little bit of theory.

There is a current backup but they need to view the previous deleted ones (or at least the .jpg files).

Unless there's a backup for that file at the time that you want to restore from, I believe you're going to have a hard time getting that file without resorting to a low-level filesystem read. And even then, you may be out of luck if enough revisions have been made (or it's not a trivial filesystem like FAT).

Matthew Iselin
  • 10,400
  • 4
  • 51
  • 62
  • It is on a FAT32 drive, and I've gone in with a hex editor and verified that there are a number of deleted directories and files still present. With several hundred one letter name (deleted) directory entries available I figure I'm going to have to iterate through restoring each one and then checking each deleted directory and file entry in each one and check the first 4 bytes of each file to see if it's a valid .jpg. – Fred Aug 30 '09 at 03:30
  • Right, and that tedious process is what most file recovery software does for you. I'd highly suggest writing a code solution (a simple FAT32 driver can be whipped up in a couple of hours, in case you don't already know), as doing it by hand with a hex editor could be far more painful. – Matthew Iselin Aug 30 '09 at 22:13