Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   EXT3 Users (http://www.linux-archive.org/ext3-users/)
-   -   extcarve - ext2,ext3,ext4 file carving tool (http://www.linux-archive.org/ext3-users/538954-extcarve-ext2-ext3-ext4-file-carving-tool.html)

"Lakshmipathi.G" 06-13-2011 06:56 AM

extcarve - ext2,ext3,ext4 file carving tool
 
Hi -Updated my old project named "ext3carve" and renamed it as "extcarve" . It uses libext2fs. (To be precise,re-uses on 'debugfs' command's "dump_unused" feature)




In summary,the tool will do the following -** It will scan the linux machine ,for unused/deleted blocks and search for magic signatures. If it finds valid signature (both header and footer) It saves the file at given external drive.




Now it can recover- non-fragmented (like png,jpg,gif,html,c/cpp/php,pdf files) deleted files.One main advantage is that it opens the affected partitions on read-only mode,thus no changes made to affected disk.Disk remains the same - regardless of whether extcarve recovers them or not.




Simply usage would be -
1. Copy extcarve binary to Pen drive.
2. Plug-in the pen-drive to affected system.(the system from where you want to recover files)
3.Attach an external harddrive to affected system so that recovered files will be stored on external hdd.



3. Run the extcarve from within pendrive - Provide affected drive as input and external drive as output directory.
Checkout recovered files at external hdd.

Download url - www.giis.co.in/giis



Any feedbacks/comments are welcome.

--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

Jidong Xiao 06-14-2011 05:19 AM

extcarve - ext2,ext3,ext4 file carving tool
 
On Mon, Jun 13, 2011 at 2:56 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
> Hi -
> Updated my old project named "ext3carve" and renamed it as "extcarve" . It
> uses libext2fs. (To be precise,re-uses on 'debugfs' command's "dump_unused"
> feature)
>
> In summary,the tool will do the following -** It will scan the linux machine
> ,for unused/deleted blocks and search for magic signatures. If it finds
> valid signature (both header and footer) It saves the file at given external
> drive.
>
> Now it can recover- non-fragmented (like png,jpg,gif,html,c/cpp/php,pdf
> files) deleted files.One main advantage is that it opens the affected
> partitions on read-only mode,thus no changes made to affected disk.Disk
> remains the same - regardless of whether extcarve recovers them or not.
>
> Simply usage would be -
> 1. Copy extcarve binary to Pen drive.
> 2. Plug-in the pen-drive to affected system.(the system from where you want
> to recover files)
> 3.Attach an external harddrive to affected system so that recovered files
> will be stored on external hdd.
> 3. Run the extcarve from within pendrive - Provide affected drive as input
> and external drive as output directory.
> Checkout recovered files at external hdd.
>
> Download url - www.giis.co.in/giis
> Any feedbacks/comments are welcome.
>

What are the pros and cons when compared to ext3grep and extundelete?

In addition, what is the Pen drive? I mean, since we need to attach an
external harddrive, why don't we run the command within the harddrive?

Regards
Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

"Lakshmipathi.G" 06-14-2011 06:11 AM

extcarve - ext2,ext3,ext4 file carving tool
 
*

What are the pros and cons when compared to ext3grep and extundelete?


Carlo wood's ext3grep uses Journal entries to recover the files. If I'm not wrong extundelete ,is an extension of ext3grep which supports ext4.
If Journal entries are lost or overwritten,It would be difficult for them to recover. (Please correct me,If I'm wrong :D )*



extcarve doesn't depend on journal entries - It scans the disk for valid magic signature of a file and tries to recover them.
I think extcarve* similar to tool like foremost http://foremost.sourceforge.net/



*
In addition, what is the Pen drive? I mean, since we need to attach an

external harddrive, why don't we run the command within the harddrive?


*I was just extra-careful, I have seen some new users installs the recover software on the affected partition itself,which is not a good thing (The recover software may overwrite the file,user wants to recover) .Yes,you can install the command on external hard-drive and use it.



*
Regards

Jidong



--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

Jidong Xiao 06-14-2011 06:41 AM

extcarve - ext2,ext3,ext4 file carving tool
 
On Tue, Jun 14, 2011 at 2:11 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
>
>>
>> What are the pros and cons when compared to ext3grep and extundelete?
>>
> Carlo wood's ext3grep uses Journal entries to recover the files. If I'm not
> wrong extundelete ,is an extension of ext3grep which supports ext4.
> If Journal entries are lost or overwritten,It would be difficult for them to
> recover. (Please correct me,If I'm wrong :D )
>
> extcarve doesn't depend on journal entries - It scans the disk for valid
> magic signature of a file and tries to recover them.
> I think extcarve* similar to tool like foremost
> http://foremost.sourceforge.net/
>
>
Good, I tested these three tools on one of my disk, which I deleted
many files last week, the results shows:

ext3grep can list what I deleted, but cannot recover
extundelete can recover part of my files
extcarve, fails to recover any of my files, it is keeping print
messages like this:

no header found.at all
Searching Unused block 415494 which contains non-zero data:

no header found.at all
Searching Unused block 415495 which contains non-zero data:

no header found.at all
Searching Unused block 415496 which contains non-zero data:

no header found.at all
Searching Unused block 415497 which contains non-zero data:

no header found.at all
Searching Unused block 415498 which contains non-zero data:

no header found.at all
Searching Unused block 415499 which contains non-zero data:

no header found.at all
Searching Unused block 415500 which contains non-zero data:

no header found.at all
Searching Unused block 415501 which contains non-zero data:

no header found.at all
Searching Unused block 415502 which contains non-zero data:

no header found.at all
Searching Unused block 415503 which contains non-zero data:

no header found.at all
Searching Unused block 415504 which contains non-zero data:

no header found.at all
Searching Unused block 415505 which contains non-zero data:

no header found.at all
Searching Unused block 415506 which contains non-zero data:

no header found.at all
Searching Unused block 415507 which contains non-zero data:

no header found.at all
Searching Unused block 415508 which contains non-zero data:

no header found.at all
Searching Unused block 415509 which contains non-zero data:

I saw almost a million of such lines.

>>
>> In addition, what is the Pen drive? I mean, since we need to attach an
>> external harddrive, why don't we run the command within the harddrive?
>>
>
> I was just extra-careful, I have seen some new users installs the recover
> software on the affected partition itself,which is not a good thing (The
> recover software may overwrite the file,user wants to recover) .Yes,you can
> install the command on external hard-drive and use it.
>
>
Okay, I see, thank you.

Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

"Lakshmipathi.G" 06-14-2011 07:18 AM

extcarve - ext2,ext3,ext4 file carving tool
 
extcarve, fails to recover any of my files, it is keeping print

messages like this:



no header found.at all

Searching Unused block 415494 which contains non-zero data:



no header found.at all

Searching Unused block 415495 which contains non-zero data:



I saw almost a million of such lines.

It will scan for unused/deleted blocks (415494, 415495 etc). While scanning It throws out such* output* messages.
When I finds valid header+footer it saves them on external drive. As of now, extcarve can recover* only limited non-fragmented files of type png,jpg,gif,html,c/cpp/php,pdf .(recoverd filename will begin with extcarve<random-char>.extenstion)



current version of tool ,will not recover a partial files - It needs to be find both header and footer.

extcarve it still running or completed ?** If its completed and didn't recover any files ,then possible reason would be -


1).Deleted files are fragmented,so extcarve can't find footer.
2).Deleted files doesn't belong to currently supported file types.
3).Or simply extcarve has a bug,that needs to fixed. :P




--


----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

Jidong Xiao 06-14-2011 03:10 PM

extcarve - ext2,ext3,ext4 file carving tool
 
On Tue, Jun 14, 2011 at 3:18 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
>
>> extcarve, fails to recover any of my files, it is keeping print
>> messages like this:
>>
>> no header found.at all
>> Searching Unused block 415494 which contains non-zero data:
>>
>> no header found.at all
>> Searching Unused block 415495 which contains non-zero data:
>>
>> I saw almost a million of such lines.
>
> It will scan for unused/deleted blocks (415494, 415495 etc). While scanning
> It throws out such* output* messages.
> When I finds valid header+footer it saves them on external drive. As of now,
> extcarve can recover* only limited non-fragmented files of type
> png,jpg,gif,html,c/cpp/php,pdf .(recoverd filename will begin with
> extcarve<random-char>.extenstion)
>
> current version of tool ,will not recover a partial files - It needs to be
> find both header and footer.
>
> extcarve it still running or completed ?** If its completed and didn't
> recover any files ,then possible reason would be -
> 1).Deleted files are fragmented,so extcarve can't find footer.
> 2).Deleted files doesn't belong to currently supported file types.
> 3).Or simply extcarve has a bug,that needs to fixed. :P
>
>
>
It looks like extcarve is completed. Following is the last lines of
output I can see on the screen, and the program stalled there and not
generate any more outputs.

no header found.at all
Searching Unused block 20353513 which contains non-zero data:

no header found.at all
Searching Unused block 20353514 which contains non-zero data:

no header found.at all
Searching Unused block 20353515 which contains non-zero data:

no header found.at all
Searching Unused block 20353516 which contains non-zero data:

n

================================================

It did generate some output file under the output directory. However,
none of these files are the original files. About 196M bytes files are
generated, however, every single file is of the same size, 4KB. There
were four types of files, cpp/png/gif/pdf. I tried to open the pdf
files, it could be open, but the contents are not what I expected,
there are just some weird contents in the pdf file. Actually how can a
normal pdf be only 4KB?

Regards
Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

"Lakshmipathi.G" 06-14-2011 03:38 PM

extcarve - ext2,ext3,ext4 file carving tool
 
It did generate some output file under the output directory. However,none of these files are the original files. About 196M bytes files aregenerated, however, every single file is of the same size, 4KB.


That's strange,since *while testing it i have seen files upto 274KB.*

were four types of files, cpp/png/gif/pdf. I tried to open the pdffiles, it could be open, but the contents are not what I expected,

there are just some weird contents in the pdf file. Actually how can anormal pdf be only 4KB?
I find it difficult to understand why all files are 4KB? What *was the command that you have used to invoke extcarve?

What's your file system's default block size? (Use command : tune2fs -l /dev/<your_device> *| grep "Block size") I have tested *with ext3,ext4 with 4KB as block size.




Regards

Jidong



--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

"Lakshmipathi.G" 06-14-2011 03:38 PM

extcarve - ext2,ext3,ext4 file carving tool
 
It did generate some output file under the output directory. However,none of these files are the original files. About 196M bytes files aregenerated, however, every single file is of the same size, 4KB.


That's strange,since *while testing it i have seen files upto 274KB.*

were four types of files, cpp/png/gif/pdf. I tried to open the pdffiles, it could be open, but the contents are not what I expected,

there are just some weird contents in the pdf file. Actually how can anormal pdf be only 4KB?
I find it difficult to understand why all files are 4KB? What *was the command that you have used to invoke extcarve?

What's your file system's default block size? (Use command : tune2fs -l /dev/<your_device> *| grep "Block size") I have tested *with ext3,ext4 with 4KB as block size.




Regards

Jidong



--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

Jidong Xiao 06-14-2011 05:06 PM

extcarve - ext2,ext3,ext4 file carving tool
 
On Tue, Jun 14, 2011 at 11:38 AM, Lakshmipathi.G
<lakshmipathi.g@gmail.com> wrote:
> It did generate some output file under the output directory. However,
> none of these files are the original files. About 196M bytes files are
> generated, however, every single file is of the same size, 4KB.
> That's strange,since *while testing it i have seen files upto 274KB.
>
> were four types of files, cpp/png/gif/pdf. I tried to open the pdf
> files, it could be open, but the contents are not what I expected,
> there are just some weird contents in the pdf file. Actually how can a
> normal pdf be only 4KB?
> I find it difficult to understand why all files are 4KB? What *was the
> command that you have used to invoke extcarve?
> What's your file system's default block size? (Use command : tune2fs -l
> /dev/<your_device> *| grep "Block size") I have tested
> with ext3,ext4 with 4KB as block size.
>>

I was using "extcarve -g".

Here are the information you asked:

test # tune2fs -l /dev/sda3
tune2fs 1.41.14 (22-Dec-2010)
Filesystem volume name: SCRATCH
Last mounted on: <not available>
Filesystem UUID: fe1d144c-7dac-47bf-b28d-c16aa591a1b5
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal ext_attr resize_inode dir_index
filetype sparse_super large_file
Filesystem flags: signed_directory_hash
Default mount options: (none)
Filesystem state: clean
Errors behavior: Continue
Filesystem OS type: Linux
Inode count: 28229632
Block count: 112916868
Reserved block count: 5645843
Free blocks: 111069127
Free inodes: 28205356
First block: 0
Block size: 4096
Fragment size: 4096
Reserved GDT blocks: 997
Blocks per group: 32768
Fragments per group: 32768
Inodes per group: 8192
Inode blocks per group: 512
Filesystem created: Thu Sep 24 07:08:16 2009
Last mount time: Mon Jun 13 14:59:06 2011
Last write time: Mon Jun 13 18:06:10 2011
Mount count: 4
Maximum mount count: 28
Last checked: Thu Jun 2 19:32:20 2011
Check interval: 15552000 (6 months)
Next check after: Tue Nov 29 18:32:20 2011
Reserved blocks uid: 0 (user root)
Reserved blocks gid: 0 (group root)
First inode: 11
Inode size: 256
Required extra isize: 28
Desired extra isize: 28
Journal inode: 8
Default directory hash: half_md4
Directory Hash Seed: 254f5863-3bf9-4ae9-ab99-9c433bce0aa8
Journal backup: inode blocks


Jidong

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users

"Lakshmipathi.G" 06-14-2011 06:05 PM

extcarve - ext2,ext3,ext4 file carving tool
 
> Block size: * * * * * * * 4096


Yes,your block size same as my test machine -thats fine (4KB should work fine).I *can recommend you to use option "-i" but the option "-g" should recover files upto 48KB(but we are getting only 4KB) . So using option "-i" won't make any difference here.


Files with 4KB size are possible only when extcarve finds header and footer on a single block.Other this, I'm running out of thoughts. I'll try with different data set (test in different environments) and *see whether *I can reproduce this issue.*








Jidong



--
----
Cheers,
Lakshmipathi.G
FOSS Programmer.
www.giis.co.in

_______________________________________________
Ext3-users mailing list
Ext3-users@redhat.com
https://www.redhat.com/mailman/listinfo/ext3-users


All times are GMT. The time now is 05:18 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.