I can't give you details on OS X, but I can tell you that what you're trying to do is possible. I once was using NetBeans on Linux and accidentally deleted the whole source tree for a project I was working on. If you have a second computer, do this on that, since any disk writes could possibly overwrite your deleted file.
The basic idea I had was to use grep on the hard drive device file (/dev/hdaX on linux..not sure what BSD/OSX naming is) to get the byte offset within the hard drive where the files I lost started. Then, once I had the byte offsets, I could use the dd command to copy the bytes directly from the disk. The files I needed were Java sources, so I knew I could just search the drive for package statements:
$ grep -b 'package my\.package\.' /dev/hda2 > byte-offsets
If you only have a few files, you can just write down the byte offsets that grep found and manually copy the files, but since I had about 120 source files, I wrote a Perl script that invoked dd for me. It ran something to the effect of:
$ dd bs=1 count=750000 skip=348947 if=/dev/hda2 of=/mysavedfile
The above would copy 750,000 bytes (since I set the block size to 1 byte) from the disk device, /dev/hda2, starting at the 348947th byte on the disk, to the output file /mysavedfile.
The above worked for me, and I recovered everything. However, that was on Linux, and I was very quick not to touch any new files, and to do all my research and testing on a different machine. The success of this method depends completely on whether the OS lays out files sequentially on the disk. This becomes less and less likely as the size of the file gets bigger.
hope this helps, christian.
On Feb 20, 2004, at 4:01 PM, Dan Smith wrote:
I'm looking for a tool that will search my phsical hard drive for a search string, in the same way that grep searches the file system. Perhaps something like this tool, developed by Maresware <http://www.dmares.com/maresware/html/ss.htm>. Are there any Fink or other open-source tools that will do this?
Here's some background: an important large text file has been overwritten by an empty one on my hard drive. I know there's a good chance that the original data is still on the disk, if I could just find some way to read that data.
Thanks, Dan Smith
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Fink-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-users
------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Fink-users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/fink-users
