How to use magic rescue

I've just searched an image I have created some time ago. I knew that I've put it on one of my USB-Sticks, but it seems as if I had deleted it. So how could I get the image back? Magic rescue is a program for recovering deleted files. It doesn't simply open your trash can, but it searches files which were deleted, but not overwritten.

Installation

sudo apt-get install magicrescue

Basic usage

$ magicrescue
Usage: magicrescue [-I FILE] [-M MODE] [-O [+-=][0x]OFFSET] [-b BLOCKSIZE]
    -d OUTPUT_DIR -r RECIPE1 [-r RECIPE2 [...]] DEVICE1 [DEVICE2 [...]]

  -b  Only consider files starting at a multiple of BLOCKSIZE.
  -d  Mandatory.  Output directory for found files.
  -r  Mandatory.  Recipe name, file or directory.
  -I  Read input file names from this file ("-" for stdin)
  -M  Produce machine-readable output to stdout.
  -O  Resume from specified offset (hex or decimal) in the first device.

You need recipes to use Magic Rescue. These are the basic ones:

moose@pc07:/usr/share/magicrescue/recipes$ ls
avi        flac      gzip       mp3-id3v1  nikon-raw  ppm
canon-cr2  gimp-xcf  jpeg-exif  mp3-id3v2  perl       zip
elf        gpl       jpeg-jfif  msoffice   png

Where is my USB-Stick?

$ sudo fdisk -l
[sudo] password for moose:

Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00065e10

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1       37810   303704064   83  Linux
/dev/sda2           37810       38914     8864769    5  Extended
/dev/sda5           37810       38914     8864768   82  Linux swap / Solaris

Disk /dev/sdc: 2067 MB, 2067267584 bytes
2 heads, 63 sectors/track, 32044 cylinders
Units = cylinders of 126 * 512 = 64512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x005f4d47

   Device Boot      Start         End      Blocks   Id  System
/dev/sdc1   *           1       32045     2018800    b  W95 FAT32

Usage

sudo magicrescue -r png -r jpeg-jfif -r gimp-xcf \
-r jpeg-exif -d /home/moose/output/ /dev/sdc1

Just got the image back ☺

Published


by

Category

Code

Tags

Contact