I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?
4 Answers
How can I search the partition for the sequence of bytes?
You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.
Also, one byte won't be enough to find the file.
-
-
I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually
/dev/sd??
nowdays.– ZazAug 17, 2010 at 14:29 -
@Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually
/dev/sd??
" that depends on distribution and hardware. I still have several/dev/hd??
on my 64bit Slackware 13.– SigTermAug 18, 2010 at 18:37 -
You did say " editor / viewer ". As for
hd
/sd
, forget it - it's no big deal.– ZazAug 19, 2010 at 13:09
I'm quite sure that it isn't the best solution, but you can grep the device, for example:
sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1
This will search the byte string 0x11 0x22 0x33 0x44
in /dev/hdc1
, returning a boolean result.
-
1That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result.– cYrusAug 17, 2010 at 14:47
-
Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file.– ZazAug 19, 2010 at 13:01
-
No, it won't, but if he has no luck with
grep
there's no need to bother further with that.– cYrusAug 19, 2010 at 13:37