[PLUG] File recovery

Daniel Johnson teknotus at gmail.com
Wed Feb 25 19:17:59 UTC 2009


> Meh.  Foremost is not generally good at ASCII text files.  You might
> try "-t cpp" which grabs C source code.  I suspect Perl is close enough
> that you'll get some hits.

since #! /usr/bin/perl is always on the first line of a file you can
probably speed it up by using seek to only look at the beginnings of
blocks.  So something like this. Would give you a list of byte offsets
for the beginnings of perl files.  UNTESTED!

#!/usr/bin/perl

my PARTITION;
open(PARTITION,'<','/dev/sda1');

while(seek (PARTITION,512,1))
{ if(qr{^#!\ */usr/bin/perl}){print tell(), "\n";}}



More information about the PLUG mailing list