[PLUG] trying to determine corrupted .files

Zot O'Connor zot at whiteknighthackers.com
Thu Dec 4 14:52:01 UTC 2003


I have a partially recovered system where many of the .files are
corrupted.

I am trying to determine a way to determine which of the . files are
corrupted, but this appears to not be trivial.  The criteria I would
love is:

1)  Known text file only.
2)  Has binary information in it.

An example:
.gnupg/options
         To enable full OpenPGP compliance you ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
        ...
        @ou should make sure that you have read t
        # Options for GnuPG
        # Copyright 1998, 1999, 2000, 2001 Free Software Foundation, Inc.

Some of the files can be cleaned, like the above file, some need to be
re-recovered.  The re-recovery process is not trivial so I want to
minimize the effort.

so the technique I am heading towards is something along these lines:

        find USER/\.[a-zA-Z]* -type f -exec ...

The the exec part is getting tricky but I did determine that a
moderately useful test is:

         file -k .gnupg/options
        .gnupg/options: data
        
        strings -n 40 .gnupg/options | wc -l
             28

This looks for strings greater than 40 chars long, and tells me how many
I will find.  I am then thinking of comparing file's output to wc's
output and seeing if wc > X and file says binary, then attempting a
recovery.

But before I mess too much.....  Any see an easier way to do this?

Thanks!
	


-- 
Zot O'Connor

http://www.ZotConsulting.com
http://www.WhiteKnightHackers.com





More information about the PLUG mailing list