I accidentally deleted a directory, most files that were modified since the last backup have been recovered using "foremost" but there are about 4 to 6 files "foremost" or "scalpel" did not find including one that was just created (no backup), I'd like to recover them if there is any chance, they are all text files in an ext4 partition and I know specific words used in the file that has no backup. I have also copied (with dd) the entire 5G partition to a file (called devsda9) in a larger partition with the same file system.

It seems I could recover with "hexedit", I had a look at the man page but it is too complex to learn, I have never used it and normally have no use for that sort of software.

My question is: can I search the file "devsda9" (which is itself a collection of files) with "hexedit" in a way that it stops when a given string is found so that the surrounding text is visible and can be copied and if it is not the wanted text, continue till the next occurence of the string?

If so, could someone give me the exact command to do this? Again, I have no need to learn this software.

There may also be a more suitable program but I am completely ignorant of what could be used.

Thank you for your help.

The KDE hex editor - Okteta is very good for this. Though it's a X GUI program.

1 members found this post helpful.

In the terminal you can use dhex.
Another possibility would be to use strings and grep.

1 members found this post helpful.

Have you just tried PhotoRec?

1 members found this post helpful.

Thank you all for your answers.

Using hexedit is one of those things you find are extremely simple when you try the only problem was it's too slow for that sort of work (inspecting a 5GB file one byte at a time), looking for a single string was still showing no result after 20 minutes of disk activity so I had to abandon the idea. I also found the file with no backup was not in the directory deleted after all which contributed to my decision.