cgsecurity.org

How can I tell is a FAT32 undelete is actually doing anything?

(Yesterday I did an undelete on an HTFS system and for a long time no change appeared on the screen, but I could see and hear activity on the drive being processed, so I let it run. After returned from lunch, I found thousands of undeleted files listed.)

Now I'm trying to do an undelete on an external hard drive (Western Digital) which is formatted FAT32. Although 2 files that (I believe) were NOT deleted and are the only files still on the drive appear listed on the TestDIsk screen, in white, no other files are listed in red or white. The drive is very quiet and I can detect no activity by ear and the blue power light does not appear to be flickering as it normally does when the drive is being accessed.

Is there some way to tell if TestDisk thinks it is done (and has found nothing) or is continuing to work on the drive?

For NTFS, TestDisk searchs all the deleted files and present them at once.
For FAT, TestDisk displays in red the deleted files when listing files: you need to go in the folder where were your files to undelete them.

OK, so for a FAT format I should expect to see files eligible for undelete (in red) as they are found. The absence of ANY such files after 18 hours would indicate that either none were found (which I would think rather unusual) or I did something incorrectly (which happens all too often). I'll investigate further and start a new thread if needed.

Thanks,
Chris Beall

I am not an English native speaker, but it looks like you haven't understood my answer...
If TestDisk lists the content of a FAT32 directory, all files , deleted and non deleted, are displayed as once.
You can wait for hours, the display won't be updated, it's already done.

Chris,

OK, I think I understand now. The resulting display will always be nearly immediate, since the display is based only on the directory entries and not on an examination of the data. Even on a 120 Gb disk, reading and display of the directories will occur very quickly.

In my case, there's not much to display, as the Format destroyed the data in the directory blocks. We are now using PhotoRec to extract the data.

(If I were writing an operating system, I would have it save the contents of directory blocks on the boot volume when an external drive is formatted, just in case. Wouldn't take much space. Apparently, WIndows XP doesn't do that...)

P.S. Your English is fine.