1

I'm looking for a way to search a raw block device for file type patterns on linux. The partition type is known and the partition table exists.

I want a linux based (open source maybe?) programm that allows me to search for known file types (by looking for file type patterns or header data).

Is there anything you can think about to do this?

cjc
  • 24,533
  • 2
  • 49
  • 69
omni
  • 313
  • 2
  • 4
  • 16
  • Why? What are you attempting to do? – ewwhite Oct 02 '12 at 12:55
  • Trying to find deleted (no links in the partition table) but still existing (not overwritten) files and saving them to another medium. I found that magicrescue is looking for the magic number of files and should be able to perform this task on a mounted device. – omni Oct 03 '12 at 10:50

2 Answers2

2

photorec does this. I am sure there are other tools as well, but this one is likely to already be present on your Live CD, or installable to it.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
  • Beat me to it! It's also possible to [add your own signatures](http://www.cgsecurity.org/wiki/Add_your_own_extension_to_PhotoRec) if necessary. – afrazier Oct 02 '12 at 12:53
1

"photorec" was already mentioned, so I would like to add foremost. You can just add header and footer (and size limit) to a .conf, and search for anything you wish - easier if you're searching for non-standard file formats.

mulaz
  • 10,472
  • 1
  • 30
  • 37