up vote 1 down vote favorite
1
share [g+] share [fb]

I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?

link|improve this question
feedback

migrated from stackoverflow.com Aug 17 '10 at 13:16

This question came from our site for professional and enthusiast programmers.

4 Answers

up vote 1 down vote

You might be interested by packages such as ext3grep and magicrescue.

link|improve this answer
feedback
up vote 0 down vote

How can I search the partition for the sequence of bytes?

You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.

Also, one byte won't be enough to find the file.

link|improve this answer
Where does the question say "one"? – Dennis Williamson Aug 17 '10 at 13:46
I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually /dev/sd?? nowdays. – Josh Aug 17 '10 at 14:29
@Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually /dev/sd??" that depends on distribution and hardware. I still have several /dev/hd?? on my 64bit Slackware 13. – SigTerm Aug 18 '10 at 18:37
You did say " editor / viewer ". As for hd/sd, forget it - it's no big deal. – Josh Aug 19 '10 at 13:09
feedback
up vote 0 down vote

There is a forensics tool called foremost which can help recover files.

link|improve this answer
feedback
up vote 0 down vote

I'm quite sure that it isn't the best solution, but you can grep the device, for example:

sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1

This will search the byte string 0x11 0x22 0x33 0x44 in /dev/hdc1, returning a boolean result.

link|improve this answer
1  
That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result. – cYrus Aug 17 '10 at 14:47
Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file. – Josh Aug 19 '10 at 13:01
No, it won't, but if he has no luck with grep there's no need to bother further with that. – cYrus Aug 19 '10 at 13:37
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.