Data Recovery .iso files

jmc1987 · 11-21-2011, 02:26 AM

I was cleaning up my system and I deleted a wrong .iso 9660 and am trying to use a data recover scalpel or foremost.

I've tried these

Code:

sudo foremost -t iso9660 -o /home/james/recovery -i /dev/sda3

or 

sudo foremost -t iso -o /home/james/recovery -i /dev/sda3

but only get this

Code:

james@xion:~$ sudo foremost -t iso -o /home/james/recovery -i /dev/sda3
foremost version 1.5.6 by Jesse Kornblum, Kris Kendall, and Nick Mikus.
$ foremost [-v|-V|-h|-T|-Q|-q|-a|-w-d] [-t <type>] [-s <blocks>] [-k <size>] 
    [-b <size>] [-c <file>] [-o <dir>] [-i <file] 

-V  - display copyright information and exit
-t  - specify file type.  (-t jpeg,pdf ...) 
-d  - turn on indirect block detection (for UNIX file-systems) 
-i  - specify input file (default is stdin) 
-a  - Write all headers, perform no error detection (corrupted files) 
-w  - Only write the audit file, do not write any detected files to the disk 
-o  - set output directory (defaults to output)
-c  - set configuration file to use (defaults to foremost.conf)
-q  - enables quick mode. Search are performed on 512 byte boundaries.
-Q  - enables quiet mode. Suppress output messages. 
-v  - verbose mode. Logs all messages to screen

scalpel I just don't know how to do the config file for a iso9660 file. I'ved googled this subject but nothing on getting back iso files.

How long would I have befor data isn't recoverable? Ball park answer is better than no answer.

Thanks

unSpawn · 11-21-2011, 05:58 AM

In short and in order of importance:
0. if not prohibitive size-wise, make a backup of /dev/sda3 using dd to a file on a physically different (external?) medium.
1. use tools you know work (I suggest you use Photorec on the image file you wrote).

unSpawn · 11-21-2011, 06:21 AM

Quote:

Originally Posted by jmc1987

How long would I have befor data isn't recoverable? Ball park answer is better than no answer.

The correct answer is "it depends". In short you have two enemies: write operations and time.
- Time is of the essence. The faster after the deletion you backup the partition the more chance you have. In some cases it may even be advisable to freeze the system by pulling the plug (meaning without letting file systems sync properly) and boot a Live CD to make the backup. Booting a Live CD that does not automount partitions is also a good way to ensure no disk is "repaired" as any alteration actually makes things worse.
- If the system was rebooted between deletion and recovery attempt and /dev/sda3 was set to mount automatically then the extfs Journal will have been replayed unless you intervene and manually mount it with "-o ro,norecovery,noload" args to prohibit replaying and loading of the Journal. *Not that it will help you in this case but I'd thought I'd better mention it anyway.
- If /dev/sda3 is mounted writable then generally speaking any write ops, any moving and writing of any file, after the deletion diminishes chances of recovery. There's no way telling what kind of deterioration writes result in as it depends on file system fragmentation, which locations on the disk is written to, the size of what's written, etc, etc. Obviously installing any file carvers in /dev/sda3 after the deletion is a good way to kick yourself in the Cochones.

Quote:

Originally Posted by jmc1987

I was cleaning up my system and I deleted a wrong .iso 9660

If it was a downloaded ISO then it probably can be downloaded again.

Quote:

Originally Posted by jmc1987

I'ved googled this subject but nothing on getting back iso files.

That depends on your Google-fu. Here's an old 2007 post of mine at LQ about ISO: http://www.linuxquestions.org/questi...3/#post2992101, here's a SANS Reading Room document on Data Carving Concepts (outlining tools): http://www.sans.org/reading_room/whi...concepts_32969, Brian Carrier's paper on Different interpretations of ISO9660 file systems (tool selection): http://www.dfrws.org/2010/proceedings/2010-315.pdf and Gary Kessler's file signature table (including ISO9660): http://www.garykessler.net/library/file_sigs.html.

Quote:

Originally Posted by jmc1987

and am trying to use a data recover scalpel or foremost.(..) I've tried (..) sudo foremost -t iso9660 -o /home/james/recovery -i /dev/sda3 or sudo foremost -t iso -o /home/james/recovery -i /dev/sda3 (..) scalpel I just don't know how to do the config file for a iso9660 file.

Foremost doesn't include a ISO9660 signature. Sure you can load one from Gary Kessler's file signature table but you could easily use a Live CD containing Photorec (http://www.cgsecurity.org/wiki/File_...ed_By_PhotoRec) as it supports the format.