extcarve - ext2,ext3,ext4 a file carving tool

[Lakshmipathi]

I have updated my old project named "ext3carve" and renamed it as "extcarve" .

In summary,the tool will do the following -
It will scan the linux machine ,for unused/deleted blocks and search for magic signatures. If it finds valid signature (both header and footer) It saves the file at given external drive.

Now it can recover- non-fragmented deleted files (like png,jpg,gif,html,c/cpp/php,pdf files).

One main advantage is that it opens the affected partitions on read-only mode,thus no changes made to affected disk.Disk remains the same - regardless of whether extcarve recovers them or not.

Simply usage could be -
1. Copy extcarve binary to Pen drive.
2. Plug-in the pen-drive to affected system.(the system from where you want to recover files)
3.Attach an external harddrive to affected system so that recovered files will be stored on external hdd.
3. Run the extcarve from within pendrive - Provide affected drive as input and external drive as output directory.

Checkout recovered files at external hdd.
Download url - Index of /giis

Any feedbacks are welcome.

[Lakshmipathi]

Anyone tested/tried this ?.If so, I would like to receive comments/feedbacks .:P

[nujinini]

Hello Laksh!

Sounds great. I can give it a try in my machine. But may I ask how can I get it please? Where can I download?

[Lakshmipathi]

Hello Laksh!

Sounds great. I can give it a try in my machine. But may I ask how can I get it please? Where can I download?

Sure,here is the URL Index of /giis . If you encounter any issues please post them. Default binary is 64-bit , If you are using 32-bit machine,then you would need to compile it from src.

Setup-1:
--------
For example,I have deleted important files from my root partition (sda1).
In order to recover them,I have installed extcarve on a pendrive and mounted it at /Pendrive.
To store any recovered files from extcarve output, I have mounted another (external hdd) on /extcarve

# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/sda1 146221624 123091120 15702820 89% / <---------Affected partition,where files are deleted.
/dev/sdc1 117218240 79060700 38157540 68% /extcarve <---------This will be used to save any recovered files.
/dev/sdb1 3865772 2914640 754760 80% /Pendrive <---------This contains extcarve executable.

Why this setup?
Simply we don't want extcarve to messup with original affected partition.If it recognizes some files ,it can recover them otherwise those files
will remain on /dev/sda1 unrecovered ,gives chance to recover them using other useful :D recovery tools.
Thus running extcarve doesn't affect original drive,regardless of the extcarve recover files or not.

extcarve stores the recovered files at another drive /extcarve.(Though here its external HDD,It can be pen drive too).

Run method-1:
------------
Now lets start running,tool -
# cd /Pendrive
# ./extcarve -g
This will prompt you for two inputs - (source and destination)
-----------
Please enter the device name:/dev/sda1

Please enter the output directory - (You must provide separate partition/drive's directory) :/extcarve
-----------
that's it,check out the output directory /extcarve for any recovered files.


Run method-2:
------------
There is another way to run this tool -
# cd /Pendrive
# ./extcarve -i
This will prompt you for three inputs - (source and destination and No.of blocks)
-----------
Please enter the device name:/dev/sda1

Please enter the output directory - (You must provide separate partition/drive's directory) :/extcarve

Please enter increased block limit:(default is 12) :
-----------
First two inputs are same as the used for "-g" option.Third one is new.Needs some explaination-default block limit 12 refers to how many consecutive blocks, you want to search for a file?For example , In order to recover,a png file, extcarve searches for png header and footer. Lets assume ,extcarve finds png header at unused block (say 10000) , then it will search for footer on next 12 blocks (10000,10001..10012) If it finds them - then those blocks are recovered and save as new file.If it doesn't a footer in 12 blocks. extcarve won't recover the file,since it doesn't find the footer.With default 12 blocks,(If your block size is 4KB),then extcarve will search for file size upto 48KB.

In order to increase this 12 blocks limit ,you use "-i" option.Say you want to recover an important files upto 1MB size,then increase it as -
--------
Please enter increased block limit:(default is 12) :256
--------
Now as with previous example,png footer will be searched upto block 10256.(256*4KB=1024KB=1MB)

[Lakshmipathi]

Update : If you find extcarve only recovers only 4KB files. Then use "extcarve -i" and pass 256 for the third input. If block size is 4KB then this should recover files upto 1MB (256*4KB=1MB) .

[Lakshmipathi]

Released 0.4 yesterday - Changes: Support for the LaTex (.tex) file format was added. A bug in the "-g" option was fixed. Output display was improved. Fixes were made to support for the PDF format. A file describing how to customize extcarve was added.

[Lakshmipathi]

A Quick update :
It helped user to recover 1000+ MATLAB .fig files & Added support to gzip and zip files.

I'm thinking about following short term plans/improvements -
*Recover ASCII text (Its done will be released this weekend)
*Make it more generic ie support different file system types too.(TODO)
*Allow recovery from Virtual machine images (TODO)
*salvage files -recover partial files (TODO)
*dump blocks which matches text (more like grep - TODO)
*Add more format as per user feedback

Does anyone has suggestions for file formats or features ?