MagicRescue

Description

MagicRescue opens devices for reading, scans them for file types it knows how to recover and calls an external program to extract them. It looks at magic bytes in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or partition. It works on any file system, but on very fragmented file systems it can only recover the first chunk of each file. These chunks are sometimes as big as 50MB

Usage

Syntax

magicrescue [-I FILE] [-M MODE] [-O [+-=][0x]OFFSET] [-b BLOCKSIZE]
	-d OUTPUT_DIR -r RECIPE1 [-r RECIPE2 [...]] DEVICE1 [DEVICE2 [...]]

Options

  -b  Only consider files starting at a multiple of BLOCKSIZE.
  -d  Mandatory.  Output directory for found files.
  -r  Mandatory.  Recipe name, file or directory.
  -I  Read input file names from this file ("-" for stdin)
  -M  Produce machine-readable output to stdout.
  -O  Resume from specified offset (hex or decimal) in the first device.

Example

cyborg@cyborg:~$ sudo magicrescue -r jpeg-jfif -d output /dev/sdb1
[sudo] password for cyborg: 
Found jpeg-jfif at 0x26C3280C
output/000026C3280C-0.jpg: 1387 bytes
Found jpeg-jfif at 0x277FE685
output/0000277FE685-0.jpg: 24003 bytes
Found jpeg-jfif at 0x27805C21
output/000027805C21-0.jpg: 3519 bytes
Found jpeg-jfif at 0x27809345
output/000027809345-0.jpg: 11684 bytes
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?