[PLUG] File recovery
Daniel Johnson
teknotus at gmail.com
Wed Feb 25 19:17:59 UTC 2009
> Meh. Foremost is not generally good at ASCII text files. You might
> try "-t cpp" which grabs C source code. I suspect Perl is close enough
> that you'll get some hits.
since #! /usr/bin/perl is always on the first line of a file you can
probably speed it up by using seek to only look at the beginnings of
blocks. So something like this. Would give you a list of byte offsets
for the beginnings of perl files. UNTESTED!
#!/usr/bin/perl
my PARTITION;
open(PARTITION,'<','/dev/sda1');
while(seek (PARTITION,512,1))
{ if(qr{^#!\ */usr/bin/perl}){print tell(), "\n";}}
More information about the PLUG
mailing list