retriving files with the shell

HI to all,maybe this is the wrong group where to post,but i post it,i
need some clue how can i use the shell to retrive some files on an
exeternal storage /dev/sda of 250GB
The parttitions are corrupted,so there's no sense to use testdisk or
othere programs.
I thought about hexdump,but from now on i stopped.How can i retrive
some avi or txt files under hexdump knowing those indexes?for intance
i know that the file,the avi for example is almost 700mb long how can
i know the precise ending of that file?and how than i can retriving
it?
Thanks in advance for thoseone who can helpme to understand something
of very useful,with the shell

Re: retriving files with the shell

franzi wrote:

> HI to all,maybe this is the wrong group where to post,but i post it,i
> need some clue how can i use the shell to retrive some files on an
> exeternal storage /dev/sda of 250GB
> The parttitions are corrupted,so there's no sense to use testdisk or
> othere programs.
> I thought about hexdump,but from now on i stopped.How can i retrive
> some avi or txt files under hexdump knowing those indexes?for intance
> i know that the file,the avi for example is almost 700mb long how can
> i know the precise ending of that file?and how than i can retriving
> it?
> Thanks in advance for thoseone who can helpme to understand something
> of very useful,with the shell

That really sounds like the domain of special rescue tools. First do you
understand what you want to do? Recover the files is not very specific.
Because data is stored in files which are stored in filesystems which
reside in partitions which reside on (drives or media). Depending on your
ex-filesystem the way the data stored in a file is placed on the partition
and therefore the disk is different. For instance there is usually a
filename and this is linked to a piece of information about how a file is
stored on the media. i.e.

File1's data is stored in
part 1 Disk Location offset 7839 64 Byte Block
part 2 Disk Location offset 7945 64 Byte Block
part 3 Disk Location offset 8973 64 Byte Block

File2's data is stored in
part 1 Disk Location offset 7880 64 Byte Block
part 2 Disk Location offset 8642 64 Byte Block
part 3 Disk Location offset 6944 64 Byte Block

Etc
As you can see these files are actually fragmented but when the Kernel/OS
reads the files it queries the information stored in the filesystem as to
where to load the data from next. So applications see a continuous stream
of data. The names for such things are like inodes and File Allocation
Tables which tell the system where on the disk the data is stored. Data is
stored in normally a specific size as well for instance a 4K block.

If you are trying to copy such data without knowing where each part is
stored then you will come across a problem. For example if you can find the
beginning of File1 part 1 at Disk Location offset 7839 you can read in the
block size of 64 bytes then if you read in from offset 7840 you won't get
part 2 because part 2 is stored at offset 7945. You would end up with some
other sort of data.

if you are lucky and the files are not fragmented e.g.
File1's data is stored in
part 1 Disk Location offset 7839 64 Byte Block
part 2 Disk Location offset 7840 64 Byte Block
part 3 Disk Location offset 7841 64 Byte Block

Then you can sequentially read that information off the disk and into a file
assuming you know the start and end of the File. You can use a program like
dd to do this. e.g.
$ dd if=/dev/sda skip=7839 count=3 of=File1
$ hexdump File1
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
0000600

You would use hexdump or something to see if you are getting the right data.

Unfortunately the beginning and end of a file is usually stored with the
filesystem data which you appear to have lost. Recovery of text data is
simple using this technique (beacause you can see it more easily) but
trying to recover something like an AVI file is very difficult even for
specialist software.

If you can recover even a little bit of the filesystem data then you might
have some chance but without it, oh dear. I hope that all made sense.

Richard James

Re: retriving files with the shell

franzi wrote:
> HI to all,maybe this is the wrong group where to post,but i post it,i
> need some clue how can i use the shell to retrive some files on an
> exeternal storage /dev/sda of 250GB
> The parttitions are corrupted,so there's no sense to use testdisk or
> othere programs.
> I thought about hexdump,but from now on i stopped.How can i retrive
> some avi or txt files under hexdump knowing those indexes?for intance
> i know that the file,the avi for example is almost 700mb long how can
> i know the precise ending of that file?and how than i can retriving
> it?
> Thanks in advance for thoseone who can helpme to understand something
> of very useful,with the shell
>
why do not you try a hand data recovery tools, something that I have
used in the past like

FinalData enterprise:
http://www.stellarinfo.com/linux-data-recovery.htm
http://www.unistal.com/linux-data-recovery.html

and yes, please read

http://www.tldp.org/linuxfocus/English/July2004/article340.s html

HTH, Nikhil

Re: retriving files with the shell

On 21 Ott, 13:16, Nikhil wrote:
> franzi wrote:
> > HI to all,maybe this is the wrong group where to post,but i post it,i
> > need some clue how can i use the shell to retrive some files on an
> > exeternal storage /dev/sda of 250GB
> > The parttitions are corrupted,so there's no sense to use testdisk or
> > othere programs.
> > I thought about hexdump,but from now on i stopped.How can i retrive
> > some avi or txt files under hexdump knowing those indexes?for intance
> > i know that the file,the avi for example is almost 700mb long how can
> > i know the precise ending of that file?and how than i can retriving
> > it?
> > Thanks in advance for thoseone who can helpme to understand something
> > of very useful,with the shell
>
> why do not you try a hand data recovery tools, something that I have
> used in the past like
>
> FinalData enterprise:http://www.stellarinfo.com/linux-data-recovery.ht mhttp://www.unistal.com/linux-data-recovery.html
>
> and yes, please read
>
> http://www.tldp.org/linuxfocus/English/July2004/article340.s html
>
> HTH, Nikhil

thanks both of you for anwering

Re: retriving files with the shell

franzi writes:

> The parttitions are corrupted,so there's no sense to use testdisk or
> othere programs.

Did you try fsck? It tries to rebuild/recover the file structure on
bad Unix disks. For instance, if it finds a corrupted file, it might put it
in the lost+found directory.

If the problem is bad blocks, there are commercial packages that help
repair disks with hardware problems (they repair bad blocks. One
example I hear advertized is http://en.wikipedia.org/wiki/SpinRite


On this page are alternative programs as well.