On Fri, 26 Nov 2010 18:18:16 +0100
Alexander Hall <halex@openbsd.org> wrote:

quoted text
> On 11/26/10 16:43, Antoine Jacoutot wrote:
> > On Fri, 26 Nov 2010, Predrag Punosevac wrote:
> > 
> >> Dear All,
> >>
> >> Sorry for this hasty e-mail. I have a Thanksgiving emergency here.
> >> Namely, my wife has accidentally erased all the pictures from her
> >> Sony camera (FAT 16 file system). Can anybody point me to any
> >> forensic tools in ports which can be used to recover the files. The
> >> good news is that I didn't allow her to take any photos after she did
> >> that as I recall somebody saying here that until files are not overwritten
> >> the files are not lost. I also apologize for bad formating of this message.
> >> It is sent from the web-interface.
> > 
> > Maybe this: http://www.cgsecurity.org/wiki/PhotoRec
> > (never tried)
> 
> I believe it's in sysutils/testdisk. IIRC I've used it very successfully.
> 
> /Alexander
> 

Yep sysutils/testdisk is very easy to use for this case. winternals
disk commander is even easier for this filesystem, but obviously not in
ports.

Look out for "list files" I think and have somewhere ready to copy them
to. It's also possible to rebuild the partition table without copying
the data off and simply getting it all back, this can even be
automated in many cases. You may want to make an image and work on that
just to almost guarantee you can't lose any data. I once started to
zero my system drive instead of a usb (damn sd? difference between
linux os's), that cost me a few hours, it was quite a complicated
partition setup that thankfully I'd written down when creating. I got
it all back except the first part which was just os data, replaceable
from backup too, so I now cat my usbs to null so the light/noise
confirms it's the right drive, you can't be too careful when doing
these things, especially writing.