On Sat, Sep 30, 2006 at 07:24:43PM +0200, Bambero wrote:
> Hello
>
> I need to recovery overwritten txt file.
>
> Ex.
> echo "my data" > testfile.txt
> echo "" > testfile.txt
>
> I have partition image file creted using dd.
> Is it possible to dump it and search using grep for example ?
> Is it possible to recover overwritten data ?
Well, let this teach you about the values of good backups. amrecover
(AMANDA) is considerably friendlier than what you're about to go
through... (and I can attest to both from personal experience. Ouch.)
You're quite lucky, though, to have deleted a plain text file. Provided
you still know a couple of words, you could search for them. grep -A
would work, but be careful to redirect it or it'll mess up your
terminal.
However, this doesn't help if the data is actually overwritten. In the
example you gave above, it is likely all the data is recoverable.
However, in a real-world case, it is likely that the latter command
wrote at least some data. In this case, the overwritten portion may or
may not be recoverable.
Tools like TCT (The Coroner's Toolkit, by Wietse Venema &c) or The
Sleuth Kit (more modern; apparently, Autopsy is something of a GUI for
it) could help a lot, if you're desparate.
Joachim
