Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Newbie
User Name
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!


Closed Thread
  Search this Thread
Old 06-17-2012, 10:43 PM   #1
LQ Newbie
Registered: May 2012
Posts: 11

Rep: Reputation: Disabled
How to manually recover a file using dd

I am trying to recover the two deleted files,the ones with the **, manually using DD. I dont understand how to figure out the count or the skip. I know I have to use:

dd if=filename.dd of=filename bs=1 count = skip =

Any help would be appreciated.

***0002600: e566 0069 006c 0065 0031 000f 005a 2e00f.i.l.e.1...Z. ***

0002610: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........

***0002620: e549 4c45 3120 2020 4a50 4720 0000 a545 .ILE1 JPG.E***

0002630: b940 b940 0000 a545 b940 0300 34c2 0100 .@.@...E.@..4...
0002640: 4166 0069 006c 0065 0033 000f 00d5 2e00 Af.i.l.e.3......
0002650: 7400 7800 7400 0000 ffff 0000 ffff ffff t.x.t...........
0002660: 4649 4c45 3320 2020 5458 5420 0000 a545 FILE3 TXT ...E
0002670: b940 cc40 0000 a545 b940 e500 069c 0200 .@.@...E.@......
0002680: 4166 0069 006c 0065 0034 000f 0056 2e00 Af.i.l.e.4...V..
0002690: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........
00026a0: 4649 4c45 3420 2020 4a50 4720 0000 a545 FILE4 JPG ...E
00026b0: b940 cc40 0000 a545 b940 3402 bb94 0200 .@.@...E.@4.....
00026c0: 4166 0069 006c 0065 002e 000f 0080 6400 Af.i.l.e......d.
00026d0: 6f00 6300 0000 ffff ffff 0000 ffff ffff o.c.............
00026e0: 4649 4c45 2020 2020 444f 4320 0000 b645 FILE DOC ...E
00026f0: b940 b940 0000 b645 b940 7f03 6200 0400 .@.@...E.@..b...
0002700: 4231 002e 0064 0064 0000 000f 0080 ffff B1...d.d........
0002710: ffff ffff ffff ffff ffff 0000 ffff ffff ................
Old 06-18-2012, 02:01 AM   #2
Registered: Apr 2012
Distribution: Gentoo
Posts: 562

Rep: Reputation: 133Reputation: 133
You can take a look how testdisk does it. Download a source code and explore it.
Or just use testdisk if you want just restore your file.
Old 06-18-2012, 07:04 AM   #3
LQ Newbie
Registered: May 2012
Posts: 11

Original Poster
Rep: Reputation: Disabled
must use DD

I am taking a class in forensics and the assignment says I have to use DD.
Old 06-18-2012, 07:24 AM   #4
LQ Guru
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 9,364

Rep: Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753Reputation: 2753
first you need to identify the filesystem and how a directory structure stored. next you need to find the size and location of those files and finally you can make a new copy of those files.

If someone helps you, or you approve of what's posted, click the "Add to Reputation" button, on the left of the post.
Happy with solution ... mark as SOLVED
(located in the "thread tools")
Old 06-18-2012, 03:20 PM   #5
Registered: Jul 2008
Location: Tilburg NL
Distribution: Slackware 14.2 ciurrent, kernel 3.18.11
Posts: 270

Rep: Reputation: 48
Be VERY careful with 'dd'. I understand that you do not know it's awesome power.

'dd' will do ANYTHING you tell it to do. You will not be asked whether you are sure. In general: a deleted file is gone. The longer you wait, the more sure you are it is beyond recovery. Make backups.

Did you mount the filesystem readonly immediately after deleting? Then you have a chance.
Old 06-18-2012, 03:33 PM   #6
Registered: Apr 2002
Location: in a fallen world
Distribution: slackware by choice, others too :} ... android.
Posts: 23,067
Blog Entries: 11

Rep: Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910Reputation: 910
Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed because it is a duplicate.

Follow-ups please to the ORIGINAL

Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to manually recover a file using dd liamtsw Linux - Newbie 8 06-18-2012 04:28 PM
[SOLVED] How do you find and remove largest file without having to manually type the file name am28 Linux - Newbie 4 11-23-2011 03:45 PM
How to recover a deleted file using the ext3 file system wdhpr Linux - Newbie 6 01-11-2011 10:04 PM
If I know the sector position and file size, is this sufficient to recover a file? jsstevenson Linux - General 2 09-29-2008 10:35 AM
gave wrong syntax for tar as tar -cvzf file file.tgz how to recover the file gautham Linux - General 4 04-13-2005 03:15 AM

All times are GMT -5. The time now is 09:23 PM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration