The inode table of my USB device was removed (/dev/sda). I am hoping to recover a file that contained a unique string which in hex format is:

"6d 61 79 32 30 32 30"

Is it possible to search throughout an entire partition for this hex patter? Are there clitools for this already? Or C libraries I could use?

  • Do you want to do something special to the string may2020 once you find it? It would probably be possible to just use grep on the device otherwise. If this is a data recovery attempt, make sure that you work on an image of the device rather than on the device itself.
    – Kusalananda
    May 17 '20 at 8:29
  • Hi Kusalananda, I created an image and wrote that to a disk. I found that the file format I am looking for has a special pattern using hexdump. So I thought I could find all these files using that hex pattern. Does grep work on special device files (i.e. /dev/sda)
    – user171558
    May 17 '20 at 8:36
  • Once you found the pattern in the disk image, what do you want to do with the information that the pattern was found on position 385943 within the disk image?
    – nohillside
    May 17 '20 at 8:38
  • I would find the offset of that file and recreate it using dd.
    – user171558
    May 17 '20 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.