I've just searched an image I have created some time ago. I knew that I've put it on one of my USB-Sticks, but it seems as if I had deleted it. So how could I get the image back? Magic rescue is a program for recovering deleted files. It doesn't simply open your trash can, but it searches files which were deleted, but not overwritten.
Installation
sudo apt-get install magicrescue
Basic usage
$ magicrescue
Usage: magicrescue [-I FILE] [-M MODE] [-O [+-=][0x]OFFSET] [-b BLOCKSIZE]
-d OUTPUT_DIR -r RECIPE1 [-r RECIPE2 [...]] DEVICE1 [DEVICE2 [...]]
-b Only consider files starting at a multiple of BLOCKSIZE.
-d Mandatory. Output directory for found files.
-r Mandatory. Recipe name, file or directory.
-I Read input file names from this file ("-" for stdin)
-M Produce machine-readable output to stdout.
-O Resume from specified offset (hex or decimal) in the first device.
You need recipes to use Magic Rescue. These are the basic ones:
[email protected]:/usr/share/magicrescue/recipes$ ls
avi flac gzip mp3-id3v1 nikon-raw ppm
canon-cr2 gimp-xcf jpeg-exif mp3-id3v2 perl zip
elf gpl jpeg-jfif msoffice png
Where is my USB-Stick?
$ sudo fdisk -l
[sudo] password for moose:
Disk /dev/sda: 320.1 GB, 320072933376 bytes
255 heads, 63 sectors/track, 38913 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00065e10
Device Boot Start End Blocks Id System
/dev/sda1 * 1 37810 303704064 83 Linux
/dev/sda2 37810 38914 8864769 5 Extended
/dev/sda5 37810 38914 8864768 82 Linux swap / Solaris
Disk /dev/sdc: 2067 MB, 2067267584 bytes
2 heads, 63 sectors/track, 32044 cylinders
Units = cylinders of 126 * 512 = 64512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x005f4d47
Device Boot Start End Blocks Id System
/dev/sdc1 * 1 32045 2018800 b W95 FAT32
Usage
sudo magicrescue -r png -r jpeg-jfif -r gimp-xcf \
-r jpeg-exif -d /home/moose/output/ /dev/sdc1
Just got the image back ☺