Recovering documents from damaged floppies

by Terry 'Mongoose' Hendrix II, 2002.09.30

These instructions will provide the steps needed by lab assistants with computers running Linux to recover documents from severly damaged floppy disks. The process is fairly straight forward, however there is an art to the recovery process. Tips are given to help with the art of recovery, so you can effectively recover students' term papers and assignments. Floppy based Linux distrobutions will be provided to labs running Windows, so students can boot and run from a floppy. The required programs are dd, mtools, wc, grep, and recover-word.

1. Check if other copies are available

Ask the student if they still have the document open at their machine.

2. Check filesystem on the disk

Try doing a file listing using the mdir command.
This lets you know the state of the filesystem.
If it fails completely skip to Step (3).

2b. Try a repair pass

First change to /tmp directory:

   cd /tmp

Run a check and repair on the floppy:

   /sbin/fsck.vfat -a -f -t -v -V /dev/fd0

List files on the floppy:
   mdir

Now try to copy file to /tmp:

   mcopy a:FILENAME /tmp

If the copy fails or the data is corrupt move to the next step.

3. Attempt to recover from raw disk data

Read raw data from the floppy:

dd skip=OFFSET count=1474560 obs=1 ibs=1 if=/dev/fd0 of=/tmp/disk.out

On your first try: Use an OFFSET of 0, then skip to Step ( 4).
On subsequent tries skip to Step (5).

Don't be alarmed by the possible 'input/output error' if seen here, since it would be expected on a damaged disk.

4. Attempt to find document in raw data

If you're looking for a document use recover-word or strings:
recover-word disk.out OR strings disk.out > disk.txt

Now grep what you've recovered for a unique word or phrase in the document(s).
grep -i "PHRASE" *.doc OR grep -i "PHRASE" *.txt

You're looking for content in the document, so don't grep for the filename. For example if you had the word 'woobal' in your document doc1.doc, then you'd grep for 'woobal'.

If this fails go back toStep (3).

5. Iterate recovery of raw data

Use the same process as in Step (3), but this time:
Set your OFFSET to be your last OFFSET + AmountRead + 4096.

To get the AmountRead:
   wc -c disk.out   OR    ls -l disk.out

For example:
   dd skip=1200128 count=1474560 obs=1 ibs=1 if=/dev/fd0 of=/tmp/disk.out
   wc -c disk.out

You see disk.out is 102008 bytes, so you do:

   dd skip=1302136 count=1474560 obs=1 ibs=1 if=/dev/fd0 of=/tmp/disk.out

Go back to Step (4)

When your skip size is greater then your count you can no longer continue.