Computer Help and Support

a2liberal

(1,524 posts)

15. Do you know generally about the file format

Sat Sep 5, 2015, 01:36 PM

Sep 2015

of the program whose files you're looking for? And how large are they? I would suggest grepping for "magic" strings that are likely to be in the file on the whole drive/image, and if you have hits use dd to pull out that block and surrounding blocks. If the file is small enough and/or not fragmented, you may get lucky and find it all together.

(One way to find out about the file format is to create a new file in the program, and then run hexdump -C on it to look at it)

As for your argument too long problem trying to delete html files, try xargs. However, if your file format wasn't supported by PhotoRec I doubt it'll be in the files it found. TestDisk may have an undelete that recovers files regardless of type (don't remember, but I have actually restored filesystems wholesale with it on lucky occasions)

Cannot edit, recommend, or reply in locked discussions

Edit history

Please sign in to view edit histories.

Recommendations

0 members have recommended this reply (displayed in chronological order):

23 replies

= new reply since forum marked as read

Highlight:

Anyone here ever use Scalpel to recover deleted files ? [View all] eppur_se_muova Aug 2015 OP

Nope - never heard of it left-of-center2012 Aug 2015 #1

That's kind of how I found out about scalpel ... eppur_se_muova Aug 2015 #2

You're on Linux? gvstn Aug 2015 #3

I've been searching the Web already ... eppur_se_muova Aug 2015 #4

Your problem is exactly like mine--complete destruction of the file table. gvstn Aug 2015 #5

TestDisk/PhotoRec is what got me the 850K (or so) nameless files. eppur_se_muova Aug 2015 #6

Good Luck. gvstn Aug 2015 #7

A little w0nderer Aug 2015 #8

Thanks, looks like some useful info in that article. eppur_se_muova Aug 2015 #9

:-) slackware based w0nderer Aug 2015 #10

Well, "compile from source" drives me nuts. eppur_se_muova Sep 2015 #11

compile from source shouldn't be done WHEN you have to rescue w0nderer Sep 2015 #12

Yeah, I'm aware of the situation in that last sentence. Not average user stuff. eppur_se_muova Sep 2015 #13

is this a linux box or a mac os x box? w0nderer Sep 2015 #14

Autopsy is now supported by CAINE -- interface is fairly easy. eppur_se_muova Nov 2017 #20

Do you know generally about the file format a2liberal Sep 2015 #15

Thanks, that's how I seem to have found some of my files ... eppur_se_muova Sep 2015 #16

Awesome! a2liberal Sep 2015 #17

Spam deleted by MIR Team Bernadest Jan 2017 #18

data recovery tools for iPhone Vamksery Feb 2018 #22

welc gopiscrap Feb 2018 #23

No clue from me, but have you tried Ars Technica forums? They have helped me a lot. fleabiscuit Jan 2017 #19

Spam deleted by MIR Team wbcrogdin Dec 2017 #21