[Gllug] Recover accidentally truncated file

Alistair Mann al at lgeezer.net
Mon Aug 18 10:18:49 UTC 2008


Simon Perry wrote:
> When saving an audio stream I accidentally started writing to an 
> existing file rather than a new one. I stopped the write immediately and 
> now I have a very small file.
> 
> Is there a way that I can recover the rest of the data that was in the 
> original file? My google fu is week this morning - I'm only finding info 
> on restoring deleted files.

One can recover data within Linux fairly easily using dd. The difficulty 
comes in determining which of that data goes where ... easier with text 
files than audio I should think.

Complicated this, but should be massagable into something useful:

1. Discover what the first dozen bytes of your accidentally written file 
says: head -c 12 myfile | od -x | cut -d ' ' -f2- | tr -d '\n ' > 
/tmp/look_for_this

2. Now try and find it on the filesystem:
dd if=/dev/hda of=/tmp/file bs=5000000 skip=0 count=1
od -x /tmp/file | cut -d' ' -f2- | tr -d '\n ' >/tmp/file-hex
grep -I -fc /tmp/look_for_this /tmp/file-hex

If grep prints 0, then search the next block
dd if=/dev/hda of=/tmp/file bs=5000000 skip=1 count=1
Until you do find it.

3. If grep prints 1, then you've found it so grab as much more space as 
needed to account for your file
dd if=/dev/hda of=/tmp/file bs=5000000 skip=1 count=2

I'll leave you to work out the details of stripping the start and end of 
the resulting file to leave just the audio you originally had.

Notes:
1. Change /dev/hda to your actual hard drive.
2. If you can, set of=/tmp/file to point to a different hard drive. For 
greater luck, connect the original hard drive read only to a different 
system
3. bs=5000000 tells the computer to search 5mb at a time. You might want 
to kick that up quite a bit...
4. count=2 at the end tells the computer to grab 10mb. Again, kick it up 
depending on your file size.

You'll still also have the interesting problem of accounting for 
whatever information was actually overwritten, but I hope I've given you 
at least more ideas than blind alleys.

Cheers,
-- 
Alistair Mann



-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug




More information about the GLLUG mailing list