LinuxQuestions.org
Support LQ: Use code LQ3 and save $3 on Domain Registration
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Closed Thread
  Search this Thread
Old 06-17-2012, 11:43 PM   #1
liamtsw
LQ Newbie
 
Registered: May 2012
Posts: 11

Rep: Reputation: Disabled
How to manually recover a file using dd


I am trying to recover the two deleted files,the ones with the **, manually using DD. I dont understand how to figure out the count or the skip. I know I have to use:

dd if=filename.dd of=filename bs=1 count = skip =

Any help would be appreciated.



***0002600: e566 0069 006c 0065 0031 000f 005a 2e00f.i.l.e.1...Z. ***

0002610: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........

***0002620: e549 4c45 3120 2020 4a50 4720 0000 a545 .ILE1 JPG.E***

0002630: b940 b940 0000 a545 b940 0300 34c2 0100 .@.@...E.@..4...
0002640: 4166 0069 006c 0065 0033 000f 00d5 2e00 Af.i.l.e.3......
0002650: 7400 7800 7400 0000 ffff 0000 ffff ffff t.x.t...........
0002660: 4649 4c45 3320 2020 5458 5420 0000 a545 FILE3 TXT ...E
0002670: b940 cc40 0000 a545 b940 e500 069c 0200 .@.@...E.@......
0002680: 4166 0069 006c 0065 0034 000f 0056 2e00 Af.i.l.e.4...V..
0002690: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........
00026a0: 4649 4c45 3420 2020 4a50 4720 0000 a545 FILE4 JPG ...E
00026b0: b940 cc40 0000 a545 b940 3402 bb94 0200 .@.@...E.@4.....
00026c0: 4166 0069 006c 0065 002e 000f 0080 6400 Af.i.l.e......d.
00026d0: 6f00 6300 0000 ffff ffff 0000 ffff ffff o.c.............
00026e0: 4649 4c45 2020 2020 444f 4320 0000 b645 FILE DOC ...E
00026f0: b940 b940 0000 b645 b940 7f03 6200 0400 .@.@...E.@..b...
0002700: 4231 002e 0064 0064 0000 000f 0080 ffff B1...d.d........
0002710: ffff ffff ffff ffff ffff 0000 ffff ffff ................
 
Old 06-18-2012, 03:01 AM   #2
Teufel
Member
 
Registered: Apr 2012
Distribution: Gentoo
Posts: 510

Rep: Reputation: 120Reputation: 120
You can take a look how testdisk does it. Download a source code and explore it.
Or just use testdisk if you want just restore your file.
 
Old 06-18-2012, 08:04 AM   #3
liamtsw
LQ Newbie
 
Registered: May 2012
Posts: 11

Original Poster
Rep: Reputation: Disabled
must use DD

I am taking a class in forensics and the assignment says I have to use DD.
 
Old 06-18-2012, 08:24 AM   #4
pan64
LQ Guru
 
Registered: Mar 2012
Location: Hungary
Distribution: debian i686 (solaris)
Posts: 8,121

Rep: Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270Reputation: 2270
first you need to identify the filesystem and how a directory structure stored. next you need to find the size and location of those files and finally you can make a new copy of those files.





_____________________________________
If someone helps you, or you approve of what's posted, click the "Add to Reputation" button, on the left of the post.
Happy with solution ... mark as SOLVED
(located in the "thread tools")
 
Old 06-18-2012, 04:20 PM   #5
fruttenboel
Member
 
Registered: Jul 2008
Location: Tilburg NL
Distribution: Slackware 14.2 ciurrent, kernel 3.18.11
Posts: 270

Rep: Reputation: 48
Be VERY careful with 'dd'. I understand that you do not know it's awesome power.

'dd' will do ANYTHING you tell it to do. You will not be asked whether you are sure. In general: a deleted file is gone. The longer you wait, the more sure you are it is beyond recovery. Make backups.

Did you mount the filesystem readonly immediately after deleting? Then you have a chance.
 
Old 06-18-2012, 04:33 PM   #6
Tinkster
Moderator
 
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,066
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed because it is a duplicate.

Follow-ups please to the ORIGINAL
 
  


Closed Thread


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to manually recover a file using dd liamtsw Linux - Newbie 8 06-18-2012 05:28 PM
[SOLVED] How do you find and remove largest file without having to manually type the file name am28 Linux - Newbie 4 11-23-2011 04:45 PM
How to recover a deleted file using the ext3 file system wdhpr Linux - Newbie 6 01-11-2011 11:04 PM
If I know the sector position and file size, is this sufficient to recover a file? jsstevenson Linux - General 2 09-29-2008 11:35 AM
gave wrong syntax for tar as tar -cvzf file file.tgz how to recover the file gautham Linux - General 4 04-13-2005 04:15 AM


All times are GMT -5. The time now is 03:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration