[Gllug] Recover accidentally truncated file

[Alistair Mann]

Simon Perry wrote:
> When saving an audio stream I accidentally started writing to an 
> existing file rather than a new one. I stopped the write immediately and 
> now I have a very small file.
> 
> Is there a way that I can recover the rest of the data that was in the 
> original file? My google fu is week this morning - I'm only finding info 
> on restoring deleted files.

One can recover data within Linux fairly easily using dd. The difficulty
comes in determining which of that data goes where ... easier with text
files than audio I should think.

Complicated this, but should be massagable into something useful:

1. Discover what the first dozen bytes of your accidentally written file
says: head -c 12 myfile | od -x | cut -d ' ' -f2- | tr -d '\n ' >
/tmp/look_for_this

2. Now try and find it on the filesystem:
dd if=/dev/hda of=/tmp/file bs=5000000 skip=0 count=1
od -x /tmp/file | cut -d' ' -f2- | tr -d '\n ' >/tmp/file-hex
grep -I -fc /tmp/look_for_this /tmp/file-hex

If grep prints 0, then search the next block
dd if=/dev/hda of=/tmp/file bs=5000000 skip=1 count=1
Until you do find it.

3. If grep prints 1, then you've found it so grab as much more space as
needed to account for your file
dd if=/dev/hda of=/tmp/file bs=5000000 skip=1 count=2

I'll leave you to work out the details of stripping the start and end of
the resulting file to leave just the audio you originally had.

Notes:
1. Change /dev/hda to your actual hard drive.
2. If you can, set of=/tmp/file to point to a different hard drive. For
greater luck, connect the original hard drive read only to a different
system
3. bs=5000000 tells the computer to search 5mb at a time. You might want
to kick that up quite a bit...
4. count=2 at the end tells the computer to grab 10mb. Again, kick it up
depending on your file size.

You'll still also have the interesting problem of accounting for
whatever information was actually overwritten, but I hope I've given you
at least more ideas than blind alleys.

Cheers,
-- 
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug