anysurrect

NAME

SYNOPSIS

anysurrect [-b blocksize] [-i input_inode_table]
       [-p path_prefix] [-u file_umask] [-U dir_umask] [-fqvV] [-hH] 
       [-g plug-ins] [-e] [-t list_of_types] [-T list_of_types] 
       [-l] device inode_table [-- [module module_options [--]] ...]

filesystem_info_ext2fs_group_info: module synopsis:

ext2fs [-g blocks-per-group] [ -i bytes-per-inode] [ -N number-of-inodes] 
   [-h] [--]

DESCRIPTION

anysurrect search on device files proceeds from knowing different file types structure. Information about founded files also saves to external inode table.

anysurrect open device in read-only mode. Because the data will not changed.

At that moment anysurrect support the next file formats:

Quick Time Based Formats: MOV, and ISO Base Media Files: JPEG 2000, MPEG4, 3GP and others
images: PNG, JPEG, BMP, PNM, TIFF
audio: WAV, MIDI, MPEG3
audio and video: OGG, AVI, MPEG2 stream (depends on -lmpeg2), program multiplex MPEG2 stream
archieves: TAR, ZIP, RAR, BZIP2 (depends on -lbzip2), GZIP
documents: PDF, ODF and others ZIP-based formats will recognized as ZIP.
executable: ELF32
plain text: ASCII, 8-bit encoding, UTF-8, UTF16-BE, UTF16-LE.
CD images: ISO9660

For better recovering anysurrect may to recognize system block of the next filesystems:

EXT2FS/EXT3FS: DIRECT, INDIRECT and DOUBLE INDIRECT blocks links, inode table blocks (see -e option description)."

But text searching is expensive (in sense of processor time) operation. Because by default recognized only ASCII texts. The recognized file formats list maybe changed by -t option. End of line recognizing (Unix, DOS and MAC) tunes at compile stage by anyfs-tools/src/anysurrect/config.h file editing.

So file searching by anysurrect utility based on knowledge of internal structure of this files. Such searching doesn't depend from medium filesystem. However the original file names and directories structure will be lost.

Some methods of recovering of names demonstrates anyrename package, which can be downloaded in Download section at the anysurrect site.

anysurrect doesn't find files if it doesn't align on block boundary (for example, on ReiserFS files with size less than 4 Kb keeps in this packed format), files with tail-packing on Reiser4 or if it compressed/crypted at_filesystem_level (for example, the NTFS filesystem has such feature -- of course, Microsoft doesn't support Unix-way).

ABOUT FRAGMENTED FILES

OPTIONS

-b blocksize

Blocksize of device filesystem. This number must be power of 2, and not less than 512. By default it assigns 512 (and maybe more for device with much space)

-i input_inode_table

Input file of external inode table, possibly was got with using build_it utility. With this option searching will make through only free blocks of device. Of course, if it is possibly (if filesystem is not damaged and you need to recovery deleted files) desirable to use this option.

-p path_prefix

Prefix to creating file paths. Usefully together with -i option when at root directory of filesystem enough directories, to move all recovering files to another, more suitable for you directory.

-u file_umask

Octal mask of reseted file access permissions. By default it is 002, i.e. by default for creating files doesn't give write permission to file for other users (not users of file and users not in file group).

-U dir_umask

Similar to -u but for directories.

-f

By default the zero block marks as used (so as usually it is filesystem superblock) and doesn't process. This option allows to mark the zero block as free. `anysurrect -qvf <file> /dev/null` call is useful for anysurrect testing whether it find the file.

-q

Don't print any messages.

-v

Print founded files types, its beginning block and size.

-V

Print the version number and exit.

-h

Print options list.

-H

Print all modules options list (use with -e option). -e).

-g plug-ins

From 0.83.2 version anysurrect supports additional dynamic libraries loading for recovering of new file types. Enumerate loading libraries with space delimiters. For knowing types list use -l option. To include new file types in list for recovering use -t option.

-e

The same as
-t filesystem_info_ext2fs_direct_blocks_links filesystem_info_ext2fs_double_indirect_blocks_links filesystem_info_ext2fs_indirect_blocks_links filesystem_info_ext2fs_inode_table filesystem_info_ext2fs_group_info
So anysurrect tries use information from founded system blocks, and calls surrecters from -T list to find other files. Recognized this way files will moved to /filesystem_files directory. If file has known size (one maybe accessed in inode table), but any surrecters doesn't define the type of the file, then the file moves to /filesystem_file/UNKNOWN directory. For the best result of recovering from EXT2FS/EXT3FS use recovering with 2 stages:
1) in the beginning with -e option, and pointing REAL blocksize by -b option (and -i option if you used build_it before)
2) then give to the program inode_table - result of prevision stage by -i option.

-t list_of_types

From 0.83.2 version you may change list of recovering files without recompiling -- simple enumerate it with space delimiter to the option. For supported types list use -l option.

-T list_of_types

The option was appeared in 0.84.6 version. The one defines secondary list of surrecters, and maybe used with -e option to set types of files for recover with using founded FS system information.

-l

Print the full list of knowing file types for recovering.

device

Device (or simple file, device image) for file recovering.

inode_table

File for saving formed external inode table.

--

The end of the main module options (further expected the next module name)

filesystem_info_ext2fs_group_info MODULE OPTIONS

The module searches blocks groups on ext2fs filesystem, i.e. it's system information -- superblock, inode tables, inode and block allocation maps.

Besides it tries to use information from inode tables. By default the module tries to find the first superblock to know filesystem parameters from it. But you may force this values with options below. Options means accords to mke2fs(8) options.

-g blocks-per-group

Blocks Group size in blocks.

-i bytes-per-inode

Byte/inode rate.

-N number-of-inodes

Number of inodes on filesystem.

-h

Print module options.

--

The end of the module options (further expected the next module name)

USAGE EXAMPLES

Search ext2fs/ext3fs system information (4096 is usual blocksize of ext2fs/ext3fs):
$ anysurrect -b 4096 -e /dev/hda2 inode.table

Recover from /dev/hda2 jpeg, png using inode.table from prevision stage:
$ anusurrect -i inode.table -t "image_JPEG image_PNG" /dev/hda2 inode.table

Note: Since anysurrect read all information from input inode table before searching, you may use the same input file as output (also as differ files for input and output as in the next example).

Recover using inode table from build_it and moving new files to ANYSURRECT directory:
$ anusurrect -i inode.table -p "/ANYSURRECT/" /dev/hda3 inode.table2

Note: the last slash in path prefix is necessary. Otherwise there will directories as "ANYSURRECTarchieve", "ANYSURRECTimage" in root directory.

The filesystem_info_ext2fs_group_info module options list you can list with command:
$ anysurrect -eH

The ext3fs FS recovering with defining it's parameters:
$ anysurrect -b 4096 -e /dev/sda10 sda10.it -- ext2fs -i 4194304

AUTHOR

BUG REPORTS

AVAILABILITY

SEE ALSO

Index

NAME

SYNOPSIS

DESCRIPTION

ABOUT FRAGMENTED FILES

OPTIONS

filesystem_info_ext2fs_group_info MODULE OPTIONS

USAGE EXAMPLES

AUTHOR

BUG REPORTS

AVAILABILITY

SEE ALSO