Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?

share|improve this question

migrated from stackoverflow.com Aug 17 '10 at 13:16

This question came from our site for professional and enthusiast programmers.

You might be interested by packages such as ext3grep and magicrescue.

share|improve this answer

How can I search the partition for the sequence of bytes?

You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.

Also, one byte won't be enough to find the file.

share|improve this answer
    
Where does the question say "one"? – Dennis Williamson Aug 17 '10 at 13:46
    
I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually /dev/sd?? nowdays. – Zaz Aug 17 '10 at 14:29
    
@Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually /dev/sd??" that depends on distribution and hardware. I still have several /dev/hd?? on my 64bit Slackware 13. – SigTerm Aug 18 '10 at 18:37
    
You did say " editor / viewer ". As for hd/sd, forget it - it's no big deal. – Zaz Aug 19 '10 at 13:09

There is a forensics tool called foremost which can help recover files.

share|improve this answer

I'm quite sure that it isn't the best solution, but you can grep the device, for example:

sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1

This will search the byte string 0x11 0x22 0x33 0x44 in /dev/hdc1, returning a boolean result.

share|improve this answer
1  
That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result. – cYrus Aug 17 '10 at 14:47
    
Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file. – Zaz Aug 19 '10 at 13:01
    
No, it won't, but if he has no luck with grep there's no need to bother further with that. – cYrus Aug 19 '10 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .