I am trying to recover the two deleted files,the ones with the **, manually using DD. I dont understand how to figure out the count or the skip. I know I have to use:

dd if=filename.dd of=filename bs=1 count = skip =

Any help would be appreciated.



***0002600: e566 0069 006c 0065 0031 000f 005a 2e00f.i.l.e.1...Z. ***

0002610: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........

***0002620: e549 4c45 3120 2020 4a50 4720 0000 a545 .ILE1 JPG.E***

0002630: b940 b940 0000 a545 b940 0300 34c2 0100 .@.@...E.@..4...
0002640: 4166 0069 006c 0065 0033 000f 00d5 2e00 Af.i.l.e.3......
0002650: 7400 7800 7400 0000 ffff 0000 ffff ffff t.x.t...........
0002660: 4649 4c45 3320 2020 5458 5420 0000 a545 FILE3 TXT ...E
0002670: b940 cc40 0000 a545 b940 e500 069c 0200 .@.@...E.@......
0002680: 4166 0069 006c 0065 0034 000f 0056 2e00 Af.i.l.e.4...V..
0002690: 6a00 7000 6700 0000 ffff 0000 ffff ffff j.p.g...........
00026a0: 4649 4c45 3420 2020 4a50 4720 0000 a545 FILE4 JPG ...E
00026b0: b940 cc40 0000 a545 b940 3402 bb94 0200 .@.@...E.@4.....
00026c0: 4166 0069 006c 0065 002e 000f 0080 6400 Af.i.l.e......d.
00026d0: 6f00 6300 0000 ffff ffff 0000 ffff ffff o.c.............
00026e0: 4649 4c45 2020 2020 444f 4320 0000 b645 FILE DOC ...E
00026f0: b940 b940 0000 b645 b940 7f03 6200 0400 .@.@...E.@..b...
0002700: 4231 002e 0064 0064 0000 000f 0080 ffff B1...d.d........
0002710: ffff ffff ffff ffff ffff 0000 ffff ffff ................

You can take a look how testdisk does it. Download a source code and explore it.
Or just use testdisk if you want just restore your file.

I am taking a class in forensics and the assignment says I have to use DD.

first you need to identify the filesystem and how a directory structure stored. next you need to find the size and location of those files and finally you can make a new copy of those files.





_____________________________________
If someone helps you, or you approve of what's posted, click the "Add to Reputation" button, on the left of the post.
Happy with solution ... mark as SOLVED
(located in the "thread tools")

Be VERY careful with 'dd'. I understand that you do not know it's awesome power.

'dd' will do ANYTHING you tell it to do. You will not be asked whether you are sure. In general: a deleted file is gone. The longer you wait, the more sure you are it is beyond recovery. Make backups.

Did you mount the filesystem readonly immediately after deleting? Then you have a chance.

Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed because it is a duplicate.

Follow-ups please to the ORIGINAL