On Sat, Sep 30, 2006 at 07:24:43PM +0200, Bambero wrote: > Hello > > I need to recovery overwritten txt file. > > Ex. > echo "my data" > testfile.txt > echo "" > testfile.txt > > I have partition image file creted using dd. > Is it possible to dump it and search using grep for example ? > Is it possible to recover overwritten data ?
Well, let this teach you about the values of good backups. amrecover (AMANDA) is considerably friendlier than what you're about to go through... (and I can attest to both from personal experience. Ouch.) You're quite lucky, though, to have deleted a plain text file. Provided you still know a couple of words, you could search for them. grep -A would work, but be careful to redirect it or it'll mess up your terminal. However, this doesn't help if the data is actually overwritten. In the example you gave above, it is likely all the data is recoverable. However, in a real-world case, it is likely that the latter command wrote at least some data. In this case, the overwritten portion may or may not be recoverable. Tools like TCT (The Coroner's Toolkit, by Wietse Venema &c) or The Sleuth Kit (more modern; apparently, Autopsy is something of a GUI for it) could help a lot, if you're desparate. Joachim