Searching a partition for a string

Completely Clueless · 07-30-2009, 06:07 AM

Hi guys.

Somewhere on my system I have an e-mail address I need to urgently recover. It might be in a file or it might be in free space. It might also be in the swap partition. I don't know what this address is, but I know it will appear in the very close proximity to another e-mail address that I *do* know. So I need to scan the entire partition for the known address (say it's tom245@testmail.com for example) so I can locate the unknown one near it.

Can someone suggest a command line that would search the entire partition and show up the location of the known address? A dump of the cluster it's found in would be a bonus, too.

Thanks,

CC.

mrrangerman · 07-30-2009, 06:29 AM

As root

Code:

find / -name tom245@testmail.com

Completely Clueless · 07-30-2009, 06:46 AM

Quote:

Originally Posted by mrrangerman

As root

Code:

find / -name tom245@testmail.com

that won't work if the string is outside of the filesystem (in unallocated space) will it??

catkin · 07-30-2009, 07:19 AM

Hello Completely Clueless

Maybe something like (not tested)

Code:

i=0
while true
    block="$(dd if=/dev/sda1 seek=$i count=1)"
    [[ $? -ne 0 ]] && exit
    echo "$block" | grep 'some expression that matches the email address'
    let i++ 
done

replacing /dev/sda1 with the appropriate partition device.

Best

Charles

PTrenholme · 07-30-2009, 07:58 AM

I think (but haven't used it) that the foremost package can be used to do what you want to accomplish.

unSpawn · 07-30-2009, 08:58 AM

If you need inode info maybe it's easier to use the (tools from the) TASK+Autopsy toolkit?

Completely Clueless · 07-30-2009, 09:03 AM

Quote:

Originally Posted by catkin

Hello Completely Clueless

Maybe something like (not tested)

Code:

i=0
while true
    block="$(dd if=/dev/sda1 seek=$i count=1)"
    [[ $? -ne 0 ]] && exit
    echo "$block" | grep 'some expression that matches the email address'
    let i++ 
done

replacing /dev/sda1 with the appropriate partition device.

Best

Charles

Thanks, Charles. I've given it a shot (your code suggestion with necessary alterations) but am getting an error:

./searchx: line 10: syntax error near unexpected token `done'
./searchx: line 10: `done'

It's ironic. I'm on page 270 of the Linux Scripting Bible and have just finished 'for' loops. Whiles are next. Typical!!

Completely Clueless · 07-30-2009, 09:08 AM

Quote:

Originally Posted by unSpawn

If you need inode info maybe it's easier to use the (tools from the) TASK+Autopsy toolkit?

To Unspawn and PTrenholm:-

I'd have thought your suggestions are rather overkill? It should be something that can be flagged as a match using some 'dd' scan of the entire partition as suggested by Charles.

In Winders some years ago, I had a third-party program called Directory Snoop which found everything everywhere. But that was Winders, where so much of the OS is off-limits. Shouldn't need forensics for this in Linux.

colucix · 07-30-2009, 09:12 AM

Quote:

Originally Posted by Completely Clueless

./searchx: line 10: syntax error near unexpected token `done'
./searchx: line 10: `done'

The code by catkin misses a "do":

Code:

while true
do

Completely Clueless · 07-30-2009, 09:33 AM

Quote:

Originally Posted by colucix

The code by catkin misses a "do":

Code:

while true
do

Thanks, Colucix.

Well, there must be something else amiss:

Code:

1+0 records in
1+0 records out
512 bytes (512 B) copied, 2.9543e-05 seconds, 17.3 MB/s
dd: `standard output': cannot seek: Illegal seek
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000587854 seconds, 0.0 kB/s

I'm not sure what it means by "illegal seek" since I was running this as Root. :-/

catkin · 07-30-2009, 09:38 AM

Quote:

Originally Posted by Completely Clueless

Thanks, Charles. I've given it a shot (your code suggestion with necessary alterations) but am getting an error:

./searchx: line 10: syntax error near unexpected token `done'
./searchx: line 10: `done'

It's ironic. I'm on page 270 of the Linux Scripting Bible and have just finished 'for' loops. Whiles are next. Typical!!

I'm sorry, I missed a "do". Try

Code:

i=0
while true
do
    block="$(dd if=/dev/sda1 seek=$i count=1)"
    [[ $? -ne 0 ]] && exit
    echo "$block" | grep 'some expression that matches the email address'
    let i++ 
done

If that doesn't work, please post the code you tried and the output.

PTrenholme · 07-30-2009, 09:47 AM

Well, yes, I guess you could use dd:

Code:

Peter@dv9710us:~ $ echo Testing 1 2 3 > /Share/testfile
Peter@dv9710us:~ $ mount | grep Share
/dev/sda7 on /Share type ext3 (rw)   
Peter@dv9710us:~ $ sudo dd if=/dev/sda7 | grep -iaC 5 testing | hexdump -C
00000000  b0 53 f5 e5 f5 88 c4 db  cc c5 1c 95 09 91 15 00  |.S..............|
00000010  b3 53 d2 e8 11 c6 97 c8  74 a1 a8 e6 3b 81 07 a2  |.S......t...;...|
00000020  ae 06 4b e8 ba 50 61 47  a1 a4 f9 fd 42 11 9a 44  |..K..PaG....B..D|
00000030  6e 8f 4f ca 0a 4b 39 2a  49 9f c2 04 b4 12 9b 08  |n.O..K9*I.......|
00000040  31 df 51 a1 7f e7 c2 a1  cd da 01 6b ce 01 b1 63  |1.Q........k...c|
00000050  9a 41 2f ab c4 cd 7b 53  1c 3f 60 2f 9b ab e8 58  |.A/...{S.?`/...X|
00000060  ae 96 9b 35 85 d8 78 4d  ac e0 bd 59 fa 40 3b 39  |...5..xM...Y.@;9|
00000070  04 bf a7 ce 33 96 11 7c  7a fe 3e ab 05 d9 c3 99  |....3..|z.>.....|
00000080  76 49 36 6c 8f fc 4f c1  7f 93 7c d2 1b af 89 70  |vI6l..O...|....p|
00000090  fe ca 09 64 6e 72 18 46  77 22 be 35 89 fa 1e 4f  |...dnr.Fw".5...O|
000000a0  57 78 d8 92 22 11 59 bf  c5 71 0c 7a 9d 50 96 3f  |Wx..".Y..q.z.P.?|
000000b0  78 78 3e e6 36 10 29 28  96 85 2e 29 40 a2 d4 4e  |xx>.6.)(...)@..N|
000000c0  7f 12 4d 4b 5b d9 f4 c2  e9 12 1e 62 a3 74 94 15  |..MK[......b.t..|
000000d0  32 e0 dc fa fa 93 ca 93  3f aa c4 99 f3 9f 71 8e  |2.......?.....q.|
000000e0  06 10 88 d7 29 cb e7 d1  09 bc 7a b6 06 9e e9 31  |....).....z....1|
000000f0  a8 2d 3c 83 17 c4 65 56  71 fa ca a0 e9 13 05 03  |.-<...eVq.......|
00000100  35 be f6 34 a1 d5 b0 9d  4f ff a5 67 04 17 ea 07  |5..4....O..g....|
00000110  be 87 ed fa 97 86 23 5f  78 2d 79 2a ec 5c ed 7e  |......#_x-y*.\.~|
00000120  ad 95 d6 2d e3 03 19 d3  9f 3c 4d 07 d4 33 b4 ba  |...-.....<M..3..|
00000130  6b 43 4d ae 4c 6e 94 d1  a5 e1 80 56 5e c5 42 1e  |kCM.Ln.....V^.B.|
00000140  ba fa 00 a6 d8 de 80 97  4e 97 3f 93 95 8e ef 4f  |........N.?....O|
00000150  55 2e b8 b3 11 28 a9 7d  58 65 be 97 85 cc 37 e7  |U....(.}Xe....7.|
00000160  7e 25 94 9c 65 8d f0 8b  25 c6 37 1f 9a 79 52 6f  |~%..e...%.7..yRo|
00000170  45 f3 9d 1b df 85 6a 76  cf f4 e0 c7 80 f7 b9 fb  |E.....jv........|
00000180  7f 8f 8b b3 f3 26 c6 03  be 48 b0 4b 5a fa fd 36  |.....&...H.KZ..6|
00000190  c9 46 65 c4 6e 6f 70 38  30 f3 6e ac e1 c1 bd 0a  |.Fe.nop80.n.....|
000001a0  34 12 b7 c1 b3 3a 7f 2e  62 b0 33 73 23 fd 08 38  |4....:..b.3s#..8|
000001b0  2a 06 47 d7 79 42 ce 35  b6 1c 0d 4b 5d 53 46 64  |*.G.yB.5...K]SFd|
000001c0  2d 01 76 c7 d9 58 72 f3  21 e8 ed a6 e2 8b 4e f5  |-.v..Xr.!.....N.|
000001d0  58 e7 c1 1b fb fb b0 79  e6 3a 0c 01 9b fe 96 35  |X......y.:.....5|
000001e0  8d 06 c4 6c db 7c b9 fb  cc 19 34 4a 4c 9c 7a 07  |...l.|....4JL.z.|
000001f0  52 4f 36 ca c2 52 6b fa  4b 84 ef e2 b1 ed bd 3d  |RO6..Rk.K......=|
00000200  f1 0a c8 81 0f 3b fa 78  c0 e6 df e7 28 2c 89 27  |.....;.x....(,.'|
00000210  9e 90 02 73 a1 e8 cc 93  5e ed b3 31 fe 26 6b c2  |...s....^..1.&k.|
00000220  15 66 d4 96 4f 3d c6 5b  2f ad cb 0e 4b 05 df 1b  |.f..O=.[/...K...|
00000230  df ce bf 97 d0 d4 82 a0  04 65 b7 3c 7b 35 bc 91  |.........e.<{5..|
00000240  77 96 86 23 7f 3e 85 fc  70 03 2d a3 3f 7f 3d 05  |w..#.>..p.-.?.=.|
00000250  b2 54 e1 7f ce cf a0 5e  59 bd 03 03 1d fb 8a 29  |.T.....^Y......)|
00000260  0c c5 38 b9 22 cd 1b 69  ca 10 44 26 d4 41 e5 c2  |..8."..i..D&.A..|
00000270  b5 1c e0 27 41 ba ab 20  5d 7e ed d5 5d 1f e5 89  |...'A.. ]~..]...|
00000280  3f df 59 03 0d 4d 1e aa  6e 12 b8 17 3a 05 81 13  |?.Y..M..n...:...|
00000290  48 68 94 9c 43 93 6c d9  2b ea d9 3c 33 24 65 8e  |Hh..C.l.+..<3$e.|
000002a0  f8 3d 8d 88 d7 49 fd d8  8f 9f 33 e9 59 2d 98 3d  |.=...I....3.Y-.=|
000002b0  aa 83 99 48 83 5c df 49  14 bc 02 e8 91 3f eb 44  |...H.\.I.....?.D|
000002c0  68 e1 19 9a 70 2b 9f e2  8b e7 09 3b 46 d9 be 0e  |h...p+.....;F...|
000002d0  19 9a 21 3d d4 d6 ea 61  1b b4 d2 86 f3 34 42 ad  |..!=...a.....4B.|
000002e0  91 76 9c ba e3 72 29 2c  97 c4 6a f5 e9 15 38 75  |.v...r),..j...8u|
000002f0  3c 12 91 f6 73 4d 90 0d  89 d5 45 f9 6d 7d 61 f4  |<...sM....E.m}a.|
00000300  29 62 dd 1f 41 47 82 b1  e2 00 8e 8f 72 92 ce e4  |)b..AG......r...|
00000310  b0 54 f7 cb 52 38 73 75  8a af 5b fd bc e9 bf 78  |.T..R8su..[....x|
00000320  37 00 b4 c5 6b a6 05 db  9b d1 74 02 76 7b 4f 63  |7...k.....t.v{Oc|
00000330  27 e2 10 23 ea 3e df 05  07 d9 ae f5 34 0a ab 40  |'..#.>......4..@|
00000340  3b 80 bb c3 d6 74 5e 97  79 d9 fa 8b 94 4f 59 68  |;....t^.y....OYh|
00000350  9c 85 4d 7d 30 8a 55 b1  8c b1 b6 7f 4a 73 22 0e  |..M}0.U.....Js".|
00000360  a7 8f d6 17 8f 1e ef b3  b6 2b 0e f7 d1 11 17 1a  |.........+......|
00000370  9f e3 81 2f 98 2d 96 87  8a c8 bc db 4f 7a 5e b1  |.../.-......Oz^.|
00000380  f0 52 de 16 02 92 0e 5a  cb fc 70 bb 55 d1 cd 45  |.R.....Z..p.U..E|
00000390  18 46 c7 8d 90 f6 4c ef  7e 40 64 78 89 ca 75 bd  |.F....L.~@dx..u.|
000003a0  18 b0 4b 90 60 b6 18 83  6e aa c7 f9 46 76 1d 56  |..K.`...n...Fv.V|
000003b0  c2 f5 a3 f9 1c 40 1c 38  18 2e a6 f3 9f 4c 99 e4  |.....@.8.....L..|
000003c0  11 54 26 91 3e ff 92 7d  ec 5c fc 8b 33 15 7f fc  |.T&.>..}.\..3...|
000003d0  0f fa 98 e0 a7 79 0f f1  c1 c1 af e8 c7 db a2 f8  |.....y..........|
000003e0  af 77 cc 17 34 09 c6 b5  6d bf 65 e0 2c 98 db f1  |.w..4...m.e.,...|
000003f0  84 bd 86 d9 ac 34 85 49  ff 05 53 ef f6 ec 64 5d  |.....4.I..S...d]|
00000400  e1 8f ba 94 75 77 20 d9  25 64 73 e1 8d 30 e0 1c  |....uw .%ds..0..|
00000410  50 b1 7c 0b a0 27 79 40  d4 18 c9 e4 bc a8 ff dd  |P.|..'y@........|
00000420  89 cf de 8a b2 f7 4d 8f  cb 72 32 b4 5d d4 0d 72  |......M..r2.]..r|
00000430  31 d1 02 85 14 16 72 1c  51 3f 32 95 61 53 ec 7b  |1.....r.Q?2.aS.{|
00000440  e7 2b a4 f0 c9 e8 ad d4  ee a9 9d 9e 1f 1e bc bb  |.+..............|
00000450  12 7b 32 68 65 9d 61 3c  12 04 e2 59 94 f4 19 83  |.{2he.a<...Y....|
00000460  65 4e e1 80 1e 67 67 89  29 3c e6 49 ac e6 7d 67  |eN...gg.)<.I..}g|
00000470  81 cb 35 80 3c 2c 72 e9  f7 3c 04 24 2c f9 65 17  |..5.<,r..<.$,.e.|
00000480  6c 83 f1 bd a8 5e 2c 64  0b 63 e9 23 47 f2 92 06  |l....^,d.c.#G...|
00000490  69 03 69 31 5b 40 9e 1c  97 08 6c c9 45 1c 39 ed  |i.i1[@....l.E.9.|
000004a0  73 7e 45 ba 13 57 be 3d  90 5a 7b cd 89 82 2b 54  |s~E..W.=.Z{...+T|
000004b0  8b 50 f9 7e 0e 71 bc 69  a1 99 85 6b 19 fb 1c fe  |.P.~.q.i...k....|
000004c0  e3 94 8e 27 3b 43 19 ac  b5 33 bc a7 8a 33 ea 93  |...';C...3...3..|
000004d0  a5 08 33 a6 f6 84 03 78  ba 79 c4 5e 09 30 68 22  |..3....x.y.^.0h"|
000004e0  99 79 f8 1d 88 6c 8c 2f  eb f4 27 77 8f 0e cb 7b  |.y...l./..'w...{|
000004f0  83 32 e7 7a 0e 71 71 1c  ad 95 4f b4 b4 5e f3 49  |.2.z.qq...O..^.I|
00000500  df c2 df 5a 3a e7 cb 57  f6 ad 0e 07 93 eb 1a 8d  |...Z:..W........|
00000510  e5 f5 44 63 c4 5d 5a fe  dc b3 e7 bf 42 ca a0 cd  |..Dc.]Z.....B...|
00000520  f5 a2 a4 33 69 29 25 c3  d2 75 ee a1 dc e7 f7 bb  |...3i)%..u......|
00000530  ca 6d ae bf 54 01 c2 9d  01 ac 1d 57 7c 41 f2 b8  |.m..T......W|A..|
00000540  be c0 2f b2 e1 6b f6 37  dd b9 20 17 6a ac 51 ae  |../..k.7.. .j.Q.|
00000550  89 88 03 a6 58 d3 ca b4  59 3b b8 93 75 09 1d 41  |....X...Y;..u..A|
00000560  ae 71 4a ab 73 f8 f2 2b  6e cb 5e db ba 7f ba 7a  |.qJ.s..+n.^....z|
00000570  16 08 aa 2c c9 f6 b2 21  10 91 f4 bd 00 27 03 91  |...,...!.....'..|
00000580  2c 2b 61 da bc 3b 3a e2  88 04 53 bf b6 81 b6 f6  |,+a..;:...S.....|
00000590  d2 b1 08 2d ec a1 8b fe  f2 aa ee 15 77 4f 54 08  |...-........wOT.|
000005a0  97 85 5d 47 6d 60 62 bb  c5 fd fb 0f a0 e3 c2 b0  |..]Gm`b.........|
000005b0  34 1e a6 17 70 6f b9 86  f2 63 0d c7 bb 3f f2 e3  |4...po...c...?..|
000005c0  65 93 99 c2 bf c9 15 8c  13 38 0f 79 c0 31 24 37  |e........8.y.1$7|
000005d0  66 b1 8e 78 34 ce 37 51  c8 56 8e 27 b9 66 ce 4a  |f..x4.7Q.V.'.f.J|
000005e0  48 bc d5 26 41 b3 48 fa  47 29 18 7b cd b6 78 89  |H..&A.H.G).{..x.|
000005f0  a3 7a 1f e1 68 d4 b5 e3  63 fe 99 ee ca 7b 8e 92  |.z..h...c....{..|
00000600  da 41 a4 ec 9f ff 68 4e  74 a1 2f 05 54 5b 41 70  |.A....hNt./.T[Ap|
00000610  6d fb 46 6b bc 0b 5c 47  57 34 75 ab e0 b8 04 27  |m.Fk..\GW4u....'|
00000620  22 c6 54 8b 00 c2 ef 49  06 23 75 70 4d 81 92 39  |".T....I.#upM..9|
00000630  05 c9 94 20 b7 fd 5f ac  8b 24 c0 3f 11 7f dc 88  |... .._..$.?....|
00000640  84 48 1b 60 ec d3 7d 5e  35 ea 17 22 52 e6 f8 68  |.H.`..}^5.."R..h|
00000650  a9 d2 9a 86 9c d0 86 da  70 40 ac 8e 01 82 db 71  |........p@.....q|
00000660  76 45 3c 98 6d 23 ce 05  9c 29 6a d8 f9 07 82 69  |vE<.m#...)j....i|
00000670  46 56 9b 58 f1 65 3f a1  72 4b 20 ef 10 05 e0 e5  |FV.X.e?.rK .....|
00000680  89 9d d0 4c 29 4d d2 29  ec 3d b6 2e 04 1e f6 b2  |...L)M.).=......|
00000690  7e d8 dc 4e de 05 2b 76  5e cf cc db c2 2d b9 2a  |~..N..+v^....-.*|
000006a0  12 99 5e 2e 80 56 f5 00  0d fd 1d f2 36 56 b9 2a  |..^..V......6V.*|
000006b0  aa 43 98 ac 91 d3 60 0a  5c c8 52 fe 1d 7f b0 f8  |.C....`.\.R.....|
000006c0  a5 a2 d3 87 30 ac 29 0e  dc 9c 5f 49 27 49 8c e9  |....0.)..._I'I..|
000006d0  b4 f4 ae 40 20 b3 d2 85  e6 7b b5 a4 85 a2 f2 66  |...@ ....{.....f|
000006e0  eb b2 45 c0 34 68 26 7f  e1 da 99 58 7b 4f 29 36  |..E.4h&....X{O)6|
000006f0  c5 d7 70 c5 b6 21 8a ce  70 3f 5c 02 3a d0 cd 2f  |..p..!..p?\.:../|
00000700  35 6d 54 ab 48 54 65 73  74 69 6e 67 20 31 20 32  |5mT.HTesting 1 2|
00000710  20 33 0a 00 00 00 00 00  00 00 00 00 00 00 00 00  | 3..............|
00000720  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

Completely Clueless · 07-30-2009, 09:51 AM

Quote:

Originally Posted by catkin

If that doesn't work, please post the code you tried and the output.

Still not having it, I'm afraid. Running your commands as this script as Root:

Code:

#!/bin/bash
# search partition for string

i=0
while true
do
    block="$(dd if=/dev/sda4 seek=$i count=1)"
    [[ $? -ne 0 ]] && exit
    echo "$block" | grep 'xyz@yahoo.com'
    let i++
done

Gives this output to the screen:

Code:

1+0 records in
1+0 records out
512 bytes (512 B) copied, 3.059e-05 seconds, 16.7 MB/s
dd: `standard output': cannot seek: Illegal seek
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.00256583 seconds, 0.0 kB/s

Any ideas?

catkin · 07-30-2009, 09:52 AM

Quote:

Originally Posted by Completely Clueless

Thanks, Colucix.

Well, there must be something else amiss:

Code:

1+0 records in
1+0 records out
512 bytes (512 B) copied, 2.9543e-05 seconds, 17.3 MB/s
dd: `standard output': cannot seek: Illegal seek
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000587854 seconds, 0.0 kB/s

I'm not sure what it means by "illegal seek" since I was running this as Root. :-/

Maybe dd starts counting from 1 instead of zero; try changing i=0 to i=1.

Completely Clueless · 07-30-2009, 10:03 AM

Quote:

Originally Posted by catkin

Maybe dd starts counting from 1 instead of zero; try changing i=0 to i=1.

Okay. Now getting the following:-

Code:

[root@localhost bruno]# ./xsearch
dd: `standard output': cannot seek: Illegal seek
0+0 records in
0+0 records out
0 bytes (0 B) copied, 8.4019e-05 seconds, 0.0 kB/s

Perhaps sed might be a better tool?