magicrescue
Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. It looks at “magic bytes” in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or partition. As long as the file data is there, it will find it.
It works on any file system, but on very fragmented file systems it can only recover the first chunk of each file. Practical experience (this program was not written for fun) shows, however, that chunks of 30-50MB are not uncommon.
Usage
Usage: “magicrescue [options] [device]`
| Option | Description |
|---|---|
-b blocksize | Default: 1. This will direct magicrescue to only consider files that start at a multiple of the blocksize argument. The option applies only to the recipes following it, so by specifying it multiple times it can be used to get different behavior for different recipes. Using this option you can usually get better performance, but fewer files will be found. In particular, files with leading garbage (e.g. many mp3 files) and files contained inside other files are likely to be skipped. Also, some file systems don’t align small files to block boundaries, so those won’t be found this way either. If you don’t know your file system’s block size, just use the value 512, which is almost always the hardware sector size. |
-d directory | Mandatory. Output directory for found files. Make sure you have plenty of free space in this directory, especially when extracting very common file types such as jpeg or gzip files. Also make sure the file system is able to handle thousands of files in a single directory, i.e. don’t use FAT if you are extracting many files. You should not place the output directory on the same block device you are trying to rescue files from. This might add the same file to the block device ahead of the current reading position, causing magicrescue to find the same file again later. In the worst theoretical case, this could cause a loop where the same file is extracted thousands of times until disk space is exhausted. You are also likely to overwrite the deleted files you were looking for in the first place. |
-r recipe | Mandatory. Recipe name, file, or directory. Specify this as either a plain name (e.g. “jpeg-jfif”) or a path (e.g. recipes/jpeg-jfif). If it doesn’t find such a file in the current directory, it will look in ./recipes and PREFIX/share/magicrescue/recipes, where PREFIX is the path you installed to, e.g. /usr/local. If recipe is a directory, all files in that directory will be treated as recipes. Browse the PREFIX/share/magicrescue/recipes directory to see what recipes are available. A recipe is a text file, and you should read the comments inside it before using it. Either use the recipe as it is or copy it somewhere and modify it. For information on creating your own recipes, see the “RECIPES” section. |
-I file | Reads input files from file in addition to those listed on the command line. If file is -, read from standard input. Each line will be interpreted as a file name. |
-M output_mode | Produce machine-readable output to stdout. output_mode can be: - i (Print each input file name before processing),- o (Print each output file name after processing), - io (Print both input and output file names. Input file names will be prefixed by “i” and a space. Output file names will be prefixed by “o” and a space). Nothing else will be written to standard output in this mode. |
-O [+/-/=][0x]offset | Resume from the specified offset in the first device. If prefixed with 0x it will be interpreted as a hex number. The number may be prefixed with a sign: = (Seek to an absolute position (default)), + (Seek to a relative position. On regular files this does the same as the above.), - (Seek to EOF, minus the offset). |
Examples
Find jpeg files in disk image:
magicrescue -r jpeg -d recovered_files disk.img