Skip to content

Instantly share code, notes, and snippets.

@athornton
Last active August 29, 2015 14:15
Show Gist options
  • Save athornton/002db97c60ce36ef2699 to your computer and use it in GitHub Desktop.
Save athornton/002db97c60ce36ef2699 to your computer and use it in GitHub Desktop.
#!/bin/bash
DEVICE="/dev/rdisk0s2"
INITIAL_CHUNK=$((64 * 1024 * 1024))
# Probably want larger on a modern Mac
FINALSIZE=$(( 64 * 1024 )) # 64K is easy enough to eyeball
# Important to split up the target this way
# so that the script doesn't just find itself!
TARGET="frostbit"
TARGET="${TARGET} moon"
function search_for_text() {
local input=$1
local size=$2
local targetsize=$3
local target=$4
local d=""
if [ -n "${TMPDIR}" ]; then
d=${TMPDIR}
else
d="/tmp"
fi
local output="${d}/chunk${size}"
local tried=0
local found=0
while : ; do
local i=0
if [ "${tried}" -ne 0 ]; then
size=$(( size / 2 ))
echo 1>&2 "Missed target in first pass. Offset ${size}/retry."
count=2
skip=1
else
skip=0
count=1
fi
while : ; do
echo 1>&2 "Looking for target text in chunk # ${i}"
ebs=$(( size * count ))
echo 1>&2 "Blocksize ${ebs}"
O=$(dd if=${input} of=${output} bs=${size} skip=${skip} count=${count} 2>&1)
rc=$?
echo 1>&2 "$O"
echo "${O}" | grep -q "^0 bytes "
rc2=$?
if [ ${rc2} -eq 0 ]; then
echo 1>&2 "No bytes read. Assuming that means end of disk."
break
fi
if [ ${rc} -ne 0 ]; then
echo 1>&2 "Disk read error."
break
fi
grep -q "${target}" ${output}
rc=$?
if [ ${rc} -eq 0 ]; then
found=1
break
fi
i=$(( i + 1 ))
skip=$(( skip + count ))
done
if [ ${found} -eq 1 ]; then
break
fi
if [ ${tried} -eq 1 ]; then
break
fi
tried=1
done
if [ ${found} -ne 1 ] ; then
# Never found it even after shifting the offset
echo ""
return
fi
if [ ${size} -le ${targetsize} ]; then
echo ${output}
return
else
size=$(( size / 64 ))
if [ ${size} -lt ${targetsize} ]; then
size=${targetsize}
fi
r=$(search_for_text ${output} ${size} ${targetsize} "${target}")
echo ${r}
return
fi
}
f=$(search_for_text ${DEVICE} ${INITIAL_CHUNK} ${FINALSIZE} "${TARGET}")
if [ -n "${f}" ]; then
echo "The text you're looking for is in ${f}."
else
echo "Sorry, but you're SOL. The text ain't there."
exit 2
fi
exit 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment