1

I lost an important file. I know what bytes the file begins with. How can I search the partition for the sequence of bytes?

4 Answers 4

1

You might be interested by packages such as ext3grep and magicrescue.

0

How can I search the partition for the sequence of bytes?

You can open partition device (such as /dev/hdc1) as a file in any hex editor/viewer your distribution has available (for example, midnight commander should be able to do that). Just make sure that you opened device in read-only mode and that your hex editor can handle files of that size.

Also, one byte won't be enough to find the file.

4
  • Where does the question say "one"? Aug 17, 2010 at 13:46
  • I've never tried it, but opening a whole disk in an editor sounds like a bad idea. Also, it's usually /dev/sd?? nowdays.
    – Zaz
    Aug 17, 2010 at 14:29
  • @Josh: "but opening a whole disk in an editor sounds like a bad idea", don't open it in editor, open it in viewer. For example, launch mc, select disk device, press F3. "Also, it's usually /dev/sd??" that depends on distribution and hardware. I still have several /dev/hd?? on my 64bit Slackware 13.
    – SigTerm
    Aug 18, 2010 at 18:37
  • You did say " editor / viewer ". As for hd/sd, forget it - it's no big deal.
    – Zaz
    Aug 19, 2010 at 13:09
0

There is a forensics tool called foremost which can help recover files.

0

I'm quite sure that it isn't the best solution, but you can grep the device, for example:

sudo grep `echo -e "\x11\x22\x33\x44"` /dev/hdc1

This will search the byte string 0x11 0x22 0x33 0x44 in /dev/hdc1, returning a boolean result.

3
  • 1
    That will return a phrase saying something like: "The binary file /dev/hdc1 matches". So a boolean result.
    – cYrus
    Aug 17, 2010 at 14:47
  • Sorry, you're right, grep does return a 'boolean' result for binary files. Either way, though, your code won't help the questioner recover his file.
    – Zaz
    Aug 19, 2010 at 13:01
  • No, it won't, but if he has no luck with grep there's no need to bother further with that.
    – cYrus
    Aug 19, 2010 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .