View Single Post
Old 18 January 2010, 01:29   #6
prowler
Global Moderator

prowler's Avatar
 
Join Date: Aug 2008
Location: Sidcup, England
Posts: 10,204
Using DiskSalv, and working with a copy of the disk obtained from the image which TSGui produced from the original, I have been able to recover almost everything which was on the disk before it was overwritten!

First, I had to let DiskSalv validate the disk, for it wouldn't let me do anything else without that step. Then, I searched for deleted files, but there weren't any.

Next, I carried out a salvage operation to a folder on my hard drive, and recovered the boot sector, volume information and all the files and directory structure of the disk with no reported errors.

Naturally, this information reflected the change in volume name from "ADF117a" to "Protext Data Disc", modified the disk creation date (again) and included an extra file which had been added to the disk by the owner, but it was an excellent start.

Finally, I let DiskSalv repair the disk, which saved the date and time stamps of all the directories, but killed one of the files, due to data errors.

Unfortunately, the damaged file is not only the largest on the disk (approx. 700kB), but it's also a compressed (lzx) archive.

Therefore it is likely that the salvaged version of this file is damaged with at least as many errors as there were checksum errors on the original disk, and the tight compression of lzx archives will make it difficult to repair.

However, there is some good news: I have downloaded a copy of AFCD 33 from the EAB File Server, and that includes the content of the AF117 coverdisks as uncompressed files. I can therefore attempt to recreate the compressed archive (or maybe just the damaged portions of it) by trial and error, looking at the damaged archive with a binary file editor to discover which files to compress and in which order.

Thanks, Toni and Thomas, for your help, which got me started.

PS. I think that the most likely cause of the damage to the filesystem of this disk is that it was removed from the disk drive while it was being written to. I don't expect to find that that the boot sector is infected with a virus, but that's something else I will check with the binary file editor.

Last edited by prowler; 19 January 2010 at 00:32.
prowler is offline  
 
Page generated in 0.09015 seconds with 9 queries