[rescue] Data rescue

[Eric Webb]

On Thursday 23 January 2003 03:38 pm, Curtis H. Wilbar Jr. wrote:
>
> So, on to the rescue... here is my idea... get a snapshot of the
> hard drive into a file on a Unix box, and use a program/write a program
> that goes through the file 512 bytes at a time (block size) or whatever
> the cluster size is (probably more efficient), and analyze the intial
> bytes looking for the "signature" of a jpeg file.  If one is found, it
> "recovers" a file (filename unknown).  If it doesn't see a sig it moves
> onto the next block or cluster.

Well that would be lovely if it weren't for a thing called fragmentation.  I 
know you said the disk was relatively static, but I'm sure you'll run into 
fragmentation anyway.

> And NO, there were no backups...

> I tried to make an image into a file with Linux, and it got to 2 gig
> and said max filesize reached (using dd).  I don't know if that is a
> limitation of VFAT filesystems where I was writing the image, or if Linux
> has a 2 gig filesize limit.

I'm not sure about ext2's limitations, but maybe check the linux equiv of 
/etc/security/limits?

-E.