ext3_last_resort.py

#!/usr/bin/env python
import sys
import subprocess

def grep(fd, magic, chunk_size=1024, alignement=0):
    """
    Iteratively yield positions of the magic in a file descriptor

    :param fd: open file descriptor (device or a file)
    :param magic: substring to find
    :param chunk_size: the length of the chunk to seek in
    :param alignement: if alignement is non-zero, then yield only positions
                       whose address % alignement == 0
    """
    base_offset = 0
    while True:
        # read contents
        contents = fd.read(chunk_size)
        if not contents:
            return
        # find substring in contents
        start_position = 0
        while True:
            idx = contents.find(magic, start_position)
            if idx == -1:
                break
            target_offset = base_offset + idx
            if not alignement or target_offset % alignement == 0:
                yield target_offset
            start_position += idx + len(magic)
        # next iteration
        base_offset += len(contents)


def mount_cmd(offset, device='/dev/sda', directory='/mnt/tmp'):
    """
    Return command to mount device with a given offset.

    There is a "natural" offset of magic number in a file system, which is
    0x438, and the current value of offset will be decreased to this
    "natural" value.
    """
    natural_offset = 0x438
    target_offset = offset - natural_offset
    command = [
        'mount', '-t', 'ext2',
        '-o', 'ro,loop,offset={0}'.format(target_offset),
        device, directory
    ]
    return command


def do_mount(device, directory):
    """
    Mount until success
    """
    fd = open(device, 'r')
    for record in grep(fd, '\x53\xef'):
        cmd = mount_cmd(record,  device=device, directory=directory)
        retcode = subprocess.call(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        cmd_str = ' '.join(cmd)
        if retcode == 0:
            print('Success. Check the directory {0} and press enter'.format(directory))
            raw_input('%s\n' % cmd_str)
            subprocess.call(['umount', directory],
                            stdout=subprocess.PIPE, stderr=subprocess.PIPE)

if __name__ == '__main__':
    do_mount(sys.argv[1], '/mnt/tmp')