Problem recovering from FAT32 drive

[kcomprepair]

Hi guys,

I recently did a ddrescue image of a failing drive and then used OSFMount on my Win7 64 machine to mount it.

After deselecting read only and selecting the image file, im presented with an option to mount the main partition or the whole drive (main leads to a 'this drive needs to be formatted' error), so I select the partition (labeled as Win95, FAT32) and it shows up in my computer as a local disk with

(134GB free of 149GB)

It's completely empty though. I'm showing hidden files, but nothing. Scanning with recuva right now and its finding files but says its going to take days possibly. Anything else I can try?

Thanks!

[David (PassMark)]

I would initially backup the dd image, so that if something goes wrong you can start again.

Then I would try using OSForensics to browse the image file without mounting it with a windows drive letter. Doing this effectively bypasses the operating system and windows explorer.

In OSF you need to "Create a case" then "Add a device to the case". The device in this case is your image file. Then you can use the OSF "File system browser" to see what is on the disk, if anything.

[kcomprepair]

I would initially backup the dd image, so that if something goes wrong you can start again.

Then I would try using OSForensics to browse the image file without mounting it with a windows drive letter. Doing this effectively bypasses the operating system and windows explorer.

In OSF you need to "Create a case" then "Add a device to the case". The device in this case is your image file. Then you can use the OSF "File system browser" to see what is on the disk, if anything.

Thanks I'll try that

[kcomprepair]

No luck with the forensics application, just shows up empty =/ After a couple days with recuva I did find about 500 files, so that may be it. thanks!

[David (PassMark)]

If the master file table as been destroyed then you could also try the deleted files search function in OSF (make sure you pick the 'File carving' option however).

[kcomprepair]

If the master file table as been destroyed then you could also try the deleted files search function in OSF (make sure you pick the 'File carving' option however).

Ill keep that in mind for next time, thank you for all your help!

[kcomprepair]

If the master file table as been destroyed then you could also try the deleted files search function in OSF (make sure you pick the 'File carving' option however).

Hi David,

Thanks for your help before. I came across another case like this and this time I was able to use OSForensics to see the files, but it says copying to clipboard is not supported.

How can I export these files out to another drive to back them up? thank you

[David (PassMark)]

I assume these files are appearing in a list in the "Deleted File Search" function?

If so you can right click on a file and select "Save Deleted File".

From V2.3 onwards (currently in beta release) you can also view the deleted files as thumbnails and as a timeline. Oh, and you need the paid for software to do a bulk save. Otherwise you can save files one at a time.

[kcomprepair]

I assume these files are appearing in a list in the "Deleted File Search" function?

If so you can right click on a file and select "Save Deleted File".

Actually, they appear in the 'file system browser'.

[David (PassMark)]

Then you can right click on the file and select "Save to disk"

[kcomprepair]

Then you can right click on the file and select "Save to disk"

didn't even see the option, ill look into it, ty

[David (PassMark)]

I am referring to the 2.3.2 Beta release. I assume you are already using the beta is you are looking at deleted files in the file system browser.