Recovering files from recovered files

[tashirosgt]

Programs to recover files from hard drives often output thousands of files which are only identified by a rough classification (bin, exe, etc.) and given cryptic names like fb23404. Are there programs that sort though such a collection of files and find particular types of data files (like PDFs, MS-word documents etc.)?

I haven't faced this problem myself, but a friend has a collection files recovered from his broken MS-Windows laptop. He needs to find a few Quicken data files. If I think in terms of LInux, the solution would be to determine some strings that characterize this type of file, hopefully strings that appear in a header in the file. Then one could use standard commands (perhaps grep) to search through the files and find those that had the strings. However, given that this is such a common problem, I'd think that there is already software written to do such a task. In fact, I'd think that someone would have writen MS-Windows software to do it, but I haven't used MS-Windows in years.

[jpollard]

There is always the "file" utility.

It isn't fast, but that is because it has to read the first block of every file and match it against a fairly long "magic" list (/usr/share/misc/magic*. It recognizes about 12,000 different types of files used.

I'm not sure if it will identify Quicken files though. It is possible for you to create your own definition. The file utility uses the first n bytes of a file - the "n" is determined from the pattern being matched. This may allow you to define a custom match, and let it identify the unknown files.

For information, see "man file" and "man magic" (for how to specify patterns).

It works fairly well, and is much faster that grep or awk (which try to read the entire file).

[Adunaic]

jpollards suggestions are great but there maybe simpler ways. You mention that there is rough classification, you could search for with a certain extention if they are kept.

Using some pipes you could always filter all files ending in *.txt and grep them for ceratin strings.

I wrote a little on this with regards to data recovery and image files in the following thread: http://forums.fedoraforum.org/showthread.php?p=1585584