Re: Spelunking the places where files are not

2021-03-08 Thread Fred Cisin via cctalk
On Mon, 8 Mar 2021, John Foust via cctalk wrote: I'm familiar with the various undelete tools for Windows and Linux. Such tools may not exist or make sense for older file systems. Windows/MS-DOS was certainly not unique nor original in marking file primary directory entries (FPDE) as deleted,

Re: Spelunking the places where files are not

2021-03-08 Thread John Foust via cctalk
At 03:16 AM 3/8/2021, Tor Arntsen via cctalk wrote: >Linux distros come with a standard tool to do some of that, >'testdisk'. From the overview: I'm familiar with the various undelete tools for Windows and Linux. Such tools may not exist or make sense for older file systems. Entire files would

Re: Spelunking the places where files are not

2021-03-08 Thread emanuel stiebler via cctalk
On 2021-03-05 09:41, John Foust via cctalk wrote: > > This situation makes me hesitant to release disk images from the past. > It's one thing to do it with disks that were mine and to take responsibility > for my risk; it's another to release disks once owned and used by others. > Do the unused se

Re: Spelunking the places where files are not

2021-03-08 Thread Tor Arntsen via cctalk
On Fri, 5 Mar 2021 at 15:41, John Foust via cctalk wrote: > > > After thinking about disk imaging tools like Greaseweasel, > I started thinking about tools that would grab and examine the unused > portions of disks. > > It's obviously file-system dependent. At one level we know of > "undelete" to

Re: Spelunking the places where files are not

2021-03-07 Thread John Foust via cctalk
At 07:55 PM 3/6/2021, John Foust via cctalk wrote: >And I guess I hadn't thought of that case where the file system >named the number of bytes in the file and that the unused ends >of blocks could also contain stuff, too. Is there a name for those bytes? An interesting analysis of "slack bytes"

Re: Spelunking the places where files are not

2021-03-06 Thread John Foust via cctalk
At 07:20 PM 3/6/2021, Chuck Guzis via cctalk wrote: >The data forensics folks are at least 20 years ahead of you, John! >They're interested in *everything* on disk, active or not. Yes, I've looked at some of the high-end tools and once wondered about a career in data forensics. I've had a few con

Re: Spelunking the places where files are not

2021-03-06 Thread Chuck Guzis via cctalk
On 3/5/21 6:41 AM, John Foust via cctalk wrote: > > After thinking about disk imaging tools like Greaseweasel, > I started thinking about tools that would grab and examine the unused > portions of disks. The data forensics folks are at least 20 years ahead of you, John! They're interested in *ev

Re: Spelunking the places where files are not

2021-03-05 Thread Warner Losh via cctalk
On Fri, Mar 5, 2021 at 7:41 AM John Foust via cctalk wrote: > > After thinking about disk imaging tools like Greaseweasel, > I started thinking about tools that would grab and examine the unused > portions of disks. > I've used this to recover a couple of Univation utilities from a disk that the

Re: Spelunking the places where files are not

2021-03-05 Thread Paul Koning via cctalk
> On Mar 5, 2021, at 5:02 PM, Glen Slick via cctalk > wrote: > > On Fri, Mar 5, 2021 at 1:46 PM Paul Koning via cctalk > wrote: >> >> Yes, RT11 has contiguous files. That actually made it rather unusual. For >> example, while RSTS supports contiguous files that isn't the default and >>

Re: Spelunking the places where files are not

2021-03-05 Thread Glen Slick via cctalk
On Fri, Mar 5, 2021 at 1:46 PM Paul Koning via cctalk wrote: > > Yes, RT11 has contiguous files. That actually made it rather unusual. For > example, while RSTS supports contiguous files that isn't the default and > because of disk fragmentation wasn't commonly used. On VMS you can copy files

Re: Spelunking the places where files are not

2021-03-05 Thread Paul Koning via cctalk
> On Mar 5, 2021, at 4:11 PM, Boris Gimbarzevsky via cctalk > wrote: > > Recovering data from disks was a lot easier 30 years ago when most > filesystems had contiguous files and it was just a matter of finding file > boundaries. Was very glad of this when accidentally wiped first 200 bloc

Re: Spelunking the places where files are not

2021-03-05 Thread Boris Gimbarzevsky via cctalk
Recovering data from disks was a lot easier 30 years ago when most filesystems had contiguous files and it was just a matter of finding file boundaries. Was very glad of this when accidentally wiped first 200 blocks of an RT-11 RK05 and just had to write a FORTRAN program to copy blocks of dat

Re: Spelunking the places where files are not

2021-03-05 Thread Fred Cisin via cctalk
Three obvious possibilites for tools to help: 1) A program that makes a single large file out of all unallocated blocks, for later study and breaak-up in an editor. 2) A prograam that makes a separate file out of each unallocated block, for later study and appending in an editor. 3) An INTER

Spelunking the places where files are not

2021-03-05 Thread John Foust via cctalk
After thinking about disk imaging tools like Greaseweasel, I started thinking about tools that would grab and examine the unused portions of disks. It's obviously file-system dependent. At one level we know of "undelete" tools that could piece together recently deleted files and restore them