Re: [tlug] binary search of binary data

[Edward Wright <edw@example.com>]

Stephen,

HUGE Thank You!!
While I couldn't use your "guess", it pointed me in the right
direction. If details interest, see below.

Thanks,
Ed


On Mon, Dec 27, 2004 at 09:34:03PM +0900, Stephen J. Turnbull wrote:
> >>>>> "Edward" == Edward Wright <edw@example.com> writes:
> 
>     Edward> Feels like there should be a simple answer to this, but it
>     Edward> eludes me.
> 
> It depends on what you want to do with the bytes, and how big the file
> is.  Here's my guess

Truth be known, I had an "accident". A ~40M file was truncated to 0
length. I promptly unmounted the partition and saved it off as a
file. That is the file I want to seek in - it's about 750M. I have
manually located a few blocks that contain consecutive data. If I
can find an "indirect block" in the file system, I can recover a
big chunk of data at once. That's what I want to seek.

> 
> $ python
> >>> infile = open (FILE, "r")
> >>> s = infile.readlines()
> >>> r = compile ("\xec\xa5\xc1\x01")
> >>> m = r.search (s, 0)
> >>> while m:
> >>>  print "match at %d\n" % m.start()
> >>>  m = r.search (s, m.end())
> >>> 
> >>> ^D
> $
>

The file is too big to slurp and I don't know enough (any?) python
to modify the code. I did something similar in perl. This works. It
returns the block(s) in which the match was found which is what I need.

#!/usr/bin/perl
my $tmp;
my $rawbytes = "f1250000f2250000";
$tmp = length $rawbytes;
my $seek = pack "H$tmp", $rawbytes;
$INFILE = "/mnt/hda3/recover_src/sda2";
open INFILE, "<$INFILE";
my $i = 0;
my $buf;
while (read INFILE, $buf, 4096){
        if ( $buf =~ $seek ){
                print "Block: $i matched\n";
        }
        $i++;
}
close INFILE;

Comment: there oughta be a "binary" grep.