Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?

share|improve this question

migrated from stackoverflow.com Aug 17 '10 at 13:16

This question came from our site for professional and enthusiast programmers.

add comment

4 Answers

You might be interested by packages such as ext3grep and magicrescue.

share|improve this answer
add comment

How can I search the partition for the sequence of bytes?

You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.

Also, one byte won't be enough to find the file.

share|improve this answer
    
Where does the question say "one"? –  Dennis Williamson Aug 17 '10 at 13:46
    
I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually /dev/sd?? nowdays. –  Josh Aug 17 '10 at 14:29
    
@Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually /dev/sd??" that depends on distribution and hardware. I still have several /dev/hd?? on my 64bit Slackware 13. –  SigTerm Aug 18 '10 at 18:37
    
You did say " editor / viewer ". As for hd/sd, forget it - it's no big deal. –  Josh Aug 19 '10 at 13:09
add comment

There is a forensics tool called foremost which can help recover files.

share|improve this answer
add comment

I'm quite sure that it isn't the best solution, but you can grep the device, for example:

sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1

This will search the byte string 0x11 0x22 0x33 0x44 in /dev/hdc1, returning a boolean result.

share|improve this answer
1  
That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result. –  cYrus Aug 17 '10 at 14:47
    
Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file. –  Josh Aug 19 '10 at 13:01
    
No, it won't, but if he has no luck with grep there's no need to bother further with that. –  cYrus Aug 19 '10 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.