• Caterpillar
    Caterpillar
    Thomas
    Posts: 31 from 2004/3/31
    Quote:

    The new ext4 partition has 3.16GB of data installed to it so I guess it has overwritten the PFS metadata at the beginning of the old partition. :(



    Yes, that's bad.

    PFS reserves a certain percentage in the beginning of a partition for its directory and begins behind that with storing data.

    So if the PFS and the EXT4 partition start at about the same place, it's rather unlikely that something can still be found if the PFS partition was not filled with at least 3 GB of data and the files you are looking for are young enough to be stored later than the first 3 GB of the partition.

    Given that the directory has been overwritten completely, searching for strings in the disk dump is probably your only option. Be prepared that you really only find file contents or fragments of file contents. All meta data was stored in the directory area. There is no information in the data area about which file a piece of data belonged to or where another fragment of a fragmented file could be located or in which order fragments were stored. You won't even find file names.



    [ Edited by Thomas 19.12.2013 - 13:43 ]
  • »19.12.13 - 12:42
    Profile