binary hard drive scanner for osx

read.py

import os
import math
import datetime


def format_seconds(seconds):
	hours, remainder = divmod(int(seconds), 3600)
	minutes, seconds = divmod(remainder, 60)
	return "%03d:%02d:%02d" % (hours, minutes, seconds)


def print_sector(sector):
	lines = [sector[x:x+16] for x in range(0, len(sector), 16)]
	for i in range(len(lines)):
		line = lines[i]
		hex_line = " ".join("%02X" % c for c in line)
		str_line = "".join([".", chr(c)][0x20 <= c <= 0x7e] for c in line)
		print("%03d\t%s\t%s" % (i * 16, hex_line, str_line))


def search(search_data, start_sector, end_sector, drive_index=0, sector_size=512, read_buffer=1048576):
	sectors_per_iteration = read_buffer // sector_size
	sectors_total = end_sector - start_sector
	sectors_format = "%%0%dd" % len(str(end_sector))

	fd = os.open(r"\\.\PhysicalDrive%d" % drive_index, os.O_RDONLY|os.O_BINARY)
	current_sector = start_sector
	prev_precent = 0
	avg_iteration_time = None

	print("SEARCH: %s" % search_data)

	while current_sector <= end_sector:
		percent = round((current_sector - start_sector) / sectors_total * 100, 1)
		if percent != prev_precent:
			iterations_still = (end_sector - current_sector) // sectors_per_iteration
			print("%05.1f%% ETA: %s NEXT_SECTOR: %s" % (percent, format_seconds(iterations_still * avg_iteration_time), sectors_format % current_sector))

		start_time = datetime.datetime.now()

		os.lseek(fd, current_sector * sector_size, os.SEEK_SET)
		data = os.read(fd, read_buffer)

		index = data.find(search_data)

		end_time = datetime.datetime.now()

		if index >= 0:
			sectors_skip = math.floor(index / sector_size)
			print("SECTOR: %d" % (current_sector + sectors_skip))
			print("INDEX: %d" % (index % sector_size))
			print("POSITION: %d" % (current_sector * sector_size + index))
			print_sector(data[sectors_skip * sector_size:sectors_skip * sector_size + sector_size])
			cmd = input("Next? ")
			if cmd.lower() in ["n", "no"]:
				break
			current_sector += sectors_skip + 1
		else:
			current_sector += sectors_per_iteration

		interation_time = (end_time - start_time).total_seconds()
		if avg_iteration_time is None:
			avg_iteration_time = interation_time
		else:
			avg_iteration_time = (interation_time + avg_iteration_time) / 2

		prev_precent = percent


def main():
	search_data = b"module.exports = AppDispatcher;"
	start_sector = 409600
	start_sector = 52802464
	end_sector = 1173234008
	read_buffer = 1024 * 1024 * 10

	search(search_data=search_data, start_sector=start_sector, end_sector=end_sector, read_buffer=read_buffer)


if __name__ == "__main__":
	main()