Linux repositories inspector

anysurrect(8)

Version 0.85.0
10 Aug 2008

anyfs-tools

unix-way toolset for recovering and converting filesystems

NAME

anysurrect - search files on device and saves obtained information to external inode table file.

SYNOPSIS

anysurrect [-b blocksize] [-i input_inode_table]
        [-p ] [-u file_umask] [-U dir_umask] [-fqvV] [-hH] 
        [-g ] [-e] [-t list_of_types] [-T list_of_types] 
        [-l] [-- [module module_options [--]] ...]
filesystem_info_ext2fs_group_info: module synopsis:
ext2fs [-g blocks-per-group] [ -i bytes-per-inode] [ -N number-of-inodes] 
   [-h] [--]

DESCRIPTION

anysurrect search on device files proceeds from knowing different file types structure. Information about founded files also saves to external inode table.
anysurrect open device in read-only mode. Because the data will not changed.
At that moment anysurrect support the next file formats:
Quick Time Based Formats: MOV, and ISO Base Media Files: JPEG 2000, MPEG4, 3GP and others
images: PNG, JPEG, BMP, PNM, TIFF
audio: WAV, MIDI, MPEG3
audio and video: OGG, AVI, MPEG2 stream (depends on -lmpeg2), program multiplex MPEG2 stream
archieves: TAR, ZIP, RAR, BZIP2 (depends on -lbzip2), GZIP
documents: PDF, ODF and others ZIP-based formats will recognized as ZIP.
executable: ELF32
plain text: ASCII, 8-bit encoding, UTF-8, UTF16-BE, UTF16-LE.
CD images: ISO9660
For better recovering anysurrect may to recognize system block of the next filesystems:
EXT2FS/EXT3FS:DIRECT,INDIRECTandDOUBLEINDIRECTblockslinks, inode table blocks (see -e option description)."
But text searching is expensive (in sense of processor time) operation. Because by default recognized only ASCII texts. The recognized file formats list maybe changed by -t option. End of line recognizing (Unix, DOS and MAC) tunes at compile stage by anyfs-tools/src/anysurrect/config.h file editing.
So file searching by anysurrect utility based on knowledge of internal structure of this files. Such searching doesn’t depend from medium filesystem. However the original file names and directories structure will be lost.
Some methods of recovering of names demonstrates anyrename package, which can be downloaded in Download section at the anysurrect site.
anysurrect doesn’t find files if it doesn’t align on block boundary (for example, on ReiserFS files with size less than 4 Kb keeps in this packed format), files with tail-packing on Reiser4 or if it compressed/crypted at_filesystem_level (for example, the NTFS filesystem has such feature -- of course, Microsoft doesn’t support Unix-way).

ABOUT FRAGMENTED FILES

Experimental realization of fragmented files recovering shows that probability to connect a part of file with part of OTHER file very high. Because you may only hope on using of 2-stage recovering, when at the first stage it recovers non-fragmented files, and at the second stage -- fragmented, fragments of which parted by recovered non-fragmented files. (with -i option it does such searching). But in general the rate of fragmented file on partition is NOT so high for serious disturbs. Recovering of fragmented files may be with more success realized by searching by filesystem system information (see -e, -T options description).

OPTIONS

-b blocksize
Blocksize of device filesystem. This number must be power of 2, and not less than 512. By default it assigns 512 (and maybe more for device with much space)
-i input_inode_table
Input file of external inode table, possibly was got with using build_it utility. With this option searching will make through only free blocks of device. Of course, if it is possibly (if filesystem is not damaged and you need to recovery deleted files) desirable to use this option.
-p path_prefix
Prefix to creating file paths. Usefully together with -i option when at root directory of filesystem enough directories, to move all recovering files to another, more suitable for you directory.
-u file_umask
Octal mask of reseted file access permissions. By default it is 002, i.e. by default for creating files doesn’t give write permission to file for other users (not users of file and users not in file group).
-U dir_umask
Similar to -u but for directories.
-f By default the zero block marks as used (so as usually it is filesystem superblock) and doesn’t process. This option allows to mark the zero block as free. ‘anysurrect -qvf <file> /dev/null‘ call is useful for anysurrect testing whether it find the file.
-q Don’t print any messages.
-v Print founded files types, its beginning block and size.
-V Print the version number and exit.
-h Print options list.
-H Print all modules options list (use with -e option). -e).
-g plug-ins
From 0.83.2 version anysurrect supports additional dynamic libraries loading for recovering of new file types. Enumerate loading libraries with space delimiters. For knowing types list use -l option. To include new file types in list for recovering use -t option.
-e The same as
-t filesystem_info_ext2fs_direct_blocks_links filesystem_info_ext2fs_double_indirect_blocks_links filesystem_info_ext2fs_indirect_blocks_links filesystem_info_ext2fs_inode_table filesystem_info_ext2fs_group_info"""
So anysurrect tries use information from founded system blocks, and calls surrecters from -T list to find other files. Recognized this way files will moved to /filesystem_files directory. If file has known size (one maybe accessed in inode table), but any surrecters doesn’t define the type of the file, then the file moves to /filesystem_file/UNKNOWN directory. For the best result of recovering from EXT2FS/EXT3FS use recovering with 2 stages:
1) in the beginning with -e option, and pointing REAL blocksize by -b option (and -i option if you used build_it before)
2) then give to the program inode_table - result of prevision stage by -i option.
-t list_of_types
From 0.83.2 version you may change list of recovering files without recompiling -- simple enumerate it with space delimiter to the option. For supported types list use -l option.
-T list_of_types
The option was appeared in 0.84.6 version. The one defines secondary list of surrecters, and maybe used with -e option to set types of files for recover with using founded FS system information.
-l Print the full list of knowing file types for recovering.
device Device (or simple file, device image) for file recovering.
inode_table
File for saving formed external inode table.
-- The end of the main module options (further expected the next module name)

filesystem_info_ext2fs_group_info MODULE OPTIONS

The module searches blocks groups on ext2fs filesystem, i.e. it’s system information -- superblock, inode tables, inode and block allocation maps.
Besides it tries to use information from inode tables. By default the module tries to find the first superblock to know filesystem parameters from it. But you may force this values with options below. Options means accords to mke2fs(8) options.
-g blocks-per-group
Blocks Group size in blocks.
-i bytes-per-inode
Byte/inode rate.
-N number-of-inodes
Number of inodes on filesystem.
-h Print module options.
-- The end of the module options (further expected the next module name)

USAGE EXAMPLES

Recover from /dev/hda1 to inode.table:
$ anysurrect /dev/hda1 inode.table
Search ext2fs/ext3fs system information (4096 is usual blocksize of ext2fs/ext3fs):
$ anysurrect -b 4096 -e /dev/hda2 inode.table
Recover from /dev/hda2 jpeg, png using inode.table from prevision stage:
$ anusurrect -i inode.table -t "image_JPEG image_PNG" /dev/hda2 inode.table
Note: Since anysurrect read all information from input inode table before searching, you may use the same input file as output (also as differ files for input and output as in the next example).
Recover using inode table from build_it and moving new files to ANYSURRECT directory:
$ anusurrect -i inode.table -p "/ANYSURRECT/" /dev/hda3 inode.table2
Note: the last slash in path prefix is necessary. Otherwise there will directories as "ANYSURRECTarchieve", "ANYSURRECTimage" in root directory.
The filesystem_info_ext2fs_group_info module options list you can list with command:
$ anysurrect -eH
The ext3fs FS recovering with defining it’s parameters:
$ anysurrect -b 4096 -e /dev/sda10 sda10.it -- ext2fs -i 4194304

AUTHOR

Nikolaj Krivchenkov aka unDEFER <>

BUG REPORTS

Messages about any problem with using anyfs-tools package send to

AVAILABILITY

You can obtain the last version of package at http://anyfs-tools.sourceforge.net
⇧ Top