Coder Social home page Coder Social logo

recoverytool's Introduction

Recovery tool

A grep-like tool that is effective on large binary files, written in Go.

It is useful for data recovery on defect disk images, recovery of accidentally deleted files, etc. This tool can search for some known text passages (or byte arrays) on a whole disk image, so it might be possible to recover some lost data, e.g. ASCII text files.

Installation

Simply clone and build. No external libraries are needed.

git clone [email protected]:fengelhardt/recoverytool.git
cd recoverytool
go build .

Example uses

Create a disk image (same as dd if=/dev/sda1 of=disk.img -oflag=sync -bs=100M). It is a little bit faster than dd as recoverytool uses separate threads for reading and writing. It also prints a status report and the MD5 checksum.

sudo ./recoverytool -cp img.iso /dev/sda1

Search for byte patterns in a file image. Also works on a whole disk.

./recoverytool -m "Master's Thesis" -m "Tax report" -m "Dear Mr. Santa" disk.img > report.txt

It takes some time to run on large file images. If a pattern was found, it prints out the address in hex and some lines of context. If you stream the output to a file, like in the example above, you can let it run and analyze the result later.

Here is an example output of a simple search:

./recoverytool -m "debug" ../comcat/comcat 
> Searching ../comcat/comcat from 0 to 175e8: 95720 Bytes (95.7kB)
> Match for debug at adress 16c0d
> 16a80 .restore_stdin._ITM_registerTMCloneTable.__cxa_finalize@@GLIBC_2.2.5.__ctype_b_loc@@GLIBC_2.3.stderr@@GLIBC_2.2.5...symtab..strt
> 16b00 ab..shstrtab..interp..note.gnu.property..note.gnu.build-id..note.ABI-tag..gnu.hash..dynsym..dynstr..gnu.version..gnu.version_r..
> 16b80 rela.dyn..rela.plt..init..plt.got..plt.sec..text..fini..rodata..eh_frame_hdr..eh_frame..init_array..fini_array..dynamic..data..b
> 16c00 ss..comment..debug_aranges..debug_info..debug_abbrev..debug_line..debug_str..debug_ranges..debug_macro..........................
> 16c80 ........................................................................................................#...............8.......
> 16d00 8....... ...............................6...............X.......X.......$...............................I...............|.......
> 16d80 |....... ...............................W......o........................0...............................a.......................
> Match for debug at adress 16c1c
> 16a80 .restore_stdin._ITM_registerTMCloneTable.__cxa_finalize@@GLIBC_2.2.5.__ctype_b_loc@@GLIBC_2.3.stderr@@GLIBC_2.2.5...symtab..strt
> 16b00 ab..shstrtab..interp..note.gnu.property..note.gnu.build-id..note.ABI-tag..gnu.hash..dynsym..dynstr..gnu.version..gnu.version_r..
> 16b80 rela.dyn..rela.plt..init..plt.got..plt.sec..text..fini..rodata..eh_frame_hdr..eh_frame..init_array..fini_array..dynamic..data..b
> 16c00 ss..comment..debug_aranges..debug_info..debug_abbrev..debug_line..debug_str..debug_ranges..debug_macro..........................
> 16c80 ........................................................................................................#...............8.......
> 16d00 8....... ...............................6...............X.......X.......$...............................I...............|.......
> 16d80 |....... ...............................W......o........................0...............................a.......................

...

With a report, you can analyze what is going on around address 16c0d in the disk image:

./recoverytool -s 16c0d -n 100 -p disk.img

The length of a printed line is 128, by default. In the hex dump produced by -p, ASCII characters between #32 (' ', space) and #126 (~) are printed as they are. The characters \t, \r, \n, \f are printed as spaces, and all other characters are printed as dots (.). There is no unicode support.

You can also calculate the MD5 checksum of a file:

./recoverytool -md5 disk.img

Complete Usage and Command Line Arguments

Usage: recoverytool <options> <action> <file name>


Options:

  -b <no of bytes>
        Buffer size used. Should be plenty to avoid kernel overhead. (default 134217728)
  -s <offset>
        Begin at this byte offset (inclusively) in the source file.
  -e <offset>
        Read up to this byte offset (exclusively) in the file.
        A negative value allows to specify an ofset from the end of the file.
        A value of 0 indicates the end of the file.
  -l <number of bytes>
        Length of a "line" for report (default 128).
  -n <number of lines>
        Number of "lines" to process, as an alternative to -e flag.
  -la <number of lines>
        "Lines" of context to report after a match (default 3).
  -lb <number of lines>
        "Lines" of context to report before a match (default 3).
  -q    
        Do not print status updates.
  -v    
        Be more verbose.
  -d    
        Print debug output.
  -h
        Print a help message and exit.

        
The following actions can be chosen:

  -cp <target filename>
        Similar to dd, copy file contents to another file.
  -m <string>
        Search for a pattern. 
        Can be specified multiple times to search for several patterns in one go.
  -md5
        Calculate the md5 checksum.
  -p    
        Print out a hex dump.

recoverytool's People

Contributors

fengelhardt avatar

Watchers

 avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.