SF.net Project Page
Section: Maintenance Commands (8)
Updated: 10 Aug 2008
anysurrect - search files on device and saves obtained information
to external inode table file.
anysurrect [-b blocksize] [-i input_inode_table]
[-p path_prefix] [-u file_umask] [-U dir_umask] [-fqvV] [-hH]
[-g plug-ins] [-e] [-t list_of_types] [-T list_of_types]
[-l] device inode_table [-- [module module_options [--]] ...]
ext2fs [-g blocks-per-group] [ -i bytes-per-inode] [ -N number-of-inodes]
search on device files proceeds from knowing different file types structure.
Information about founded files also saves to external inode table.
open device in read-only mode. Because the data will not
At that moment
support the next file formats:
Quick Time Based Formats:
MOV, and ISO Base Media Files: JPEG 2000, MPEG4, 3GP and others
PNG, JPEG, BMP, PNM, TIFF
WAV, MIDI, MPEG3
audio and video:
OGG, AVI, MPEG2 stream (depends on -lmpeg2), program multiplex MPEG2 stream
TAR, ZIP, RAR, BZIP2 (depends on -lbzip2), GZIP
PDF, ODF and others ZIP-based formats will recognized as ZIP.
ASCII, 8-bit encoding, UTF-8, UTF16-BE, UTF16-LE.
For better recovering
may to recognize system block of the next filesystems:
EXT2FS/EXT3FS: DIRECT, INDIRECT and DOUBLE INDIRECT blocks links,
inode table blocks (see -e option description)."
But text searching is expensive (in sense of processor time) operation.
Because by default recognized only
texts. The recognized file formats list
maybe changed by
End of line recognizing (Unix, DOS and MAC) tunes
at compile stage by anyfs-tools/src/anysurrect/config.h file editing.
So file searching by
utility based on knowledge of internal structure of this files. Such searching
doesn't depend from medium filesystem. However the original
file names and directories structure will be lost.
Some methods of recovering of names demonstrates anyrename package, which
can be downloaded in Download section at the anysurrect site.
doesn't find files if it doesn't align on block boundary (for example, on
files with size less than 4 Kb keeps in this packed format),
files with tail-packing on Reiser4 or
if it compressed/crypted at_filesystem_level (for example, the
filesystem has such feature --
of course, Microsoft doesn't support Unix-way).
ABOUT FRAGMENTED FILES
Experimental realization of fragmented files recovering
shows that probability to connect a part of file with part of OTHER file
very high. Because you may only hope on using of 2-stage recovering,
when at the first stage it recovers non-fragmented files, and at the second
stage -- fragmented, fragments of which parted by recovered non-fragmented
option it does such searching).
But in general the rate of fragmented file on partition is NOT so high
for serious disturbs.
Recovering of fragmented files may be with more success realized
by searching by filesystem system information (see
- -b blocksize
Blocksize of device filesystem. This number must be
power of 2, and not less than 512. By default it assigns 512
(and maybe more for device with much space)
- -i input_inode_table
Input file of external inode table, possibly was got with using
With this option searching will make through only free blocks
of device. Of course, if it is possibly (if filesystem is not damaged
and you need to recovery deleted files) desirable to use this option.
- -p path_prefix
Prefix to creating file paths. Usefully together with -i option when at
root directory of filesystem enough directories, to move all recovering files
to another, more suitable for you directory.
- -u file_umask
Octal mask of reseted file access permissions. By default it is 002,
i.e. by default for creating files doesn't give write permission to file
for other users (not users of file and users not in file group).
- -U dir_umask
but for directories.
By default the zero block marks as used (so as usually it is
filesystem superblock) and doesn't process. This option allows
to mark the zero block as free. `anysurrect -qvf <file> /dev/null` call
is useful for anysurrect testing whether it find the file.
Don't print any messages.
Print founded files types, its beginning block and size.
Print the version number and exit.
Print options list.
Print all modules options list (use with
- -g plug-ins
From 0.83.2 version
supports additional dynamic libraries loading for recovering
of new file types. Enumerate loading libraries with space delimiters.
For knowing types list use
To include new file types in list for recovering use
The same as
-t filesystem_info_ext2fs_direct_blocks_links filesystem_info_ext2fs_double_indirect_blocks_links filesystem_info_ext2fs_indirect_blocks_links filesystem_info_ext2fs_inode_table filesystem_info_ext2fs_group_info
So anysurrect tries use information from founded system blocks,
and calls surrecters from
list to find other files.
Recognized this way files will moved to
If file has known size (one maybe accessed in inode table), but
any surrecters doesn't define the type of the file, then
the file moves to
For the best result of recovering from EXT2FS/EXT3FS
use recovering with 2 stages:
1) in the beginning with -e option, and pointing REAL blocksize by -b option
(and -i option if you used
2) then give to the program inode_table - result of prevision stage by -i option.
- -t list_of_types
From 0.83.2 version you may change list of recovering files without recompiling --
simple enumerate it with space delimiter to the option.
For supported types list use
- -T list_of_types
The option was appeared in 0.84.6 version.
The one defines secondary list of surrecters, and maybe
used with -e option to set types of files for recover
with using founded FS system information.
Print the full list of knowing file types for recovering.
Device (or simple file, device image) for file recovering.
File for saving formed external inode table.
The end of the main module options
(further expected the next module name)
filesystem_info_ext2fs_group_info MODULE OPTIONS
The module searches blocks groups on ext2fs filesystem,
i.e. it's system information -- superblock, inode tables, inode
and block allocation maps.
Besides it tries to use information from inode tables.
By default the module tries to find the first superblock to know
filesystem parameters from it. But you may force this values
with options below. Options means accords to
- -g blocks-per-group
Blocks Group size in blocks.
- -i bytes-per-inode
- -N number-of-inodes
Number of inodes on filesystem.
Print module options.
The end of the module options
(further expected the next module name)
Recover from /dev/hda1 to inode.table:
$ anysurrect /dev/hda1 inode.table
Search ext2fs/ext3fs system information (4096 is usual blocksize of
$ anysurrect -b 4096 -e /dev/hda2 inode.table
Recover from /dev/hda2 jpeg, png using inode.table from prevision stage:
$ anusurrect -i inode.table -t "image_JPEG image_PNG" /dev/hda2 inode.table
Note: Since anysurrect read all information from input inode table before
searching, you may use the same input file as output (also as differ files
for input and output as in the next example).
Recover using inode table from build_it and moving new files to
$ anusurrect -i inode.table -p "/ANYSURRECT/" /dev/hda3 inode.table2
Note: the last slash in path prefix is necessary. Otherwise there will
directories as "ANYSURRECTarchieve", "ANYSURRECTimage" in root directory.
module options list you can list with command:
$ anysurrect -eH
The ext3fs FS recovering with defining it's
$ anysurrect -b 4096 -e /dev/sda10 sda10.it -- ext2fs -i 4194304
Nikolaj Krivchenkov aka unDEFER <email@example.com>
Messages about any problem with using
package send to
You can obtain the last version of package at
- ABOUT FRAGMENTED FILES
- filesystem_info_ext2fs_group_info MODULE OPTIONS
- USAGE EXAMPLES
- BUG REPORTS
- SEE ALSO
This document was created by
man2html (from man 1.5o1),
using the manual pages.
Time: 21:52:21 GMT, August 16, 2008