> Thanks Daniel! I'll give it a spin and see what happens. As Hal mentioned
> earlier the image I created might have been corrupted (which it turns out it
> was) I was able to fix it with e2fsck, which may have done more damage in
> terms of getting my data back but we'll see. I did manage, using sleuthkit
> and foremost to grab some data albeit with some issues in the files but the
> recovered data was useable enough to restore some of the missing data.
You of course have to edit that to point to the right partition as I
didn't create an interface yet. Also it just gives you the byte
offset to what it found.
I just got some code working to dump a file from a byte offset. It
doesn't have an interface yet, but I thought you might be interested
in some progress.
On my system it is copytoeof.cpp. Compile with "g++ copytoeof.cpp -o copytoeof"
#include <fstream>
#include <iostream>
using namespace std;
long blockoffset = 41420800; // where I found a perl file
int main()
{
ifstream partition("/dev/sdb2",ifstream::in | ifstream::binary);
partition.seekg(blockoffset);
unsigned char c;
ofstream writefile("foundfiles/file_cout",ofstream::out | ofstream::binary);
while (c = partition.get())
if(c != 0)
{
writefile << c;
}
else
{
break;
}
writefile.close();
partition.close();
return 0;
}
_______________________________________________
PLUG mailing list
[email protected]
http://lists.pdxlinux.org/mailman/listinfo/plug
