Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?

share|improve this question

migrated from Aug 17 '10 at 13:16

This question came from our site for professional and enthusiast programmers.

You might be interested by packages such as ext3grep and magicrescue.

share|improve this answer

How can I search the partition for the sequence of bytes?

You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.

Also, one byte won't be enough to find the file.

share|improve this answer
Where does the question say "one"? – Dennis Williamson Aug 17 '10 at 13:46
I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually /dev/sd?? nowdays. – Zaz Aug 17 '10 at 14:29
@Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually /dev/sd??" that depends on distribution and hardware. I still have several /dev/hd?? on my 64bit Slackware 13. – SigTerm Aug 18 '10 at 18:37
You did say " editor / viewer ". As for hd/sd, forget it - it's no big deal. – Zaz Aug 19 '10 at 13:09

There is a forensics tool called foremost which can help recover files.

share|improve this answer

I'm quite sure that it isn't the best solution, but you can grep the device, for example:

sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1

This will search the byte string 0x11 0x22 0x33 0x44 in /dev/hdc1, returning a boolean result.

share|improve this answer
That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result. – cYrus Aug 17 '10 at 14:47
Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file. – Zaz Aug 19 '10 at 13:01
No, it won't, but if he has no luck with grep there's no need to bother further with that. – cYrus Aug 19 '10 at 13:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.