At a lower level
Posted: 05 Nov 2016, 09:37
I've used testdisk a number of times, normally to repair partition records from backups. I'm working with a drive at present for which testdisk cannot seem to recover a partition.
My understanding is that a partition table normally tells the OS where to find files. I've recently discovered that photorec CAN find files on the drive. My best guess at how it does this is by scanning the drive for patterns which match the "signatures" of certain given file types. (First question: is this assumption accurate?)
Now, I'd further understood that files can be fragmented (split across non-contiguous parts of the drive). I had understood that the FAT contained a "linked list" of where the file fragments were located. (I'm no longer sure if this is accurate, nor do I understand how this differs from NTFS.) The big question, though, is: how can photorec find complete files which had been fragmented?
I realise that you are busy and this is a complicated question. I'm just curious!
My understanding is that a partition table normally tells the OS where to find files. I've recently discovered that photorec CAN find files on the drive. My best guess at how it does this is by scanning the drive for patterns which match the "signatures" of certain given file types. (First question: is this assumption accurate?)
Now, I'd further understood that files can be fragmented (split across non-contiguous parts of the drive). I had understood that the FAT contained a "linked list" of where the file fragments were located. (I'm no longer sure if this is accurate, nor do I understand how this differs from NTFS.) The big question, though, is: how can photorec find complete files which had been fragmented?
I realise that you are busy and this is a complicated question. I'm just curious!