Top of file gone missing, can it be recovered?

Question

Hi all,
I had a file open in BBEdit Lite 6.1 for OS X and found that several pages off the top were missing, either by inadvertent edit error or bug. This I noticed after the file was saved. The file is a log file, so I always add to the end and leave the top alone, so I don't know how it got messed up, but messed up it is.
Is there any way to recover this file? I did not have backups enabled in BBEdit. Is there any way to search freed disk blocks to find blocks that contain the deleted data? I have an old backup copy that will contain much of the top, but not the middle, so I could use strings from that file as match criteria. Mac OS 9 had MacsBug which could search RAM. I doubt that can work with Mac OS X since Unix is a protected memory OS.
Any ideas would help.
Thanks,
Scott

Answer 1

WoodPlane wrote:
That looks like a way to read the whole disk to another file.
Yes.
The disk in question is an encrypted disk image, all of about 256 MB, so I have room to copy it to a different partition on the parent drive. Would the data read be encrypted or clear text?
The dd copy would be encrypted.
Why do you choose a block size of 4096? How can I tell the block size of the FS in question?
Why 4096? It's an arbitrary size (multiple of 512) to improve performance. It is the size of the memory buffer. I think the real block size is 512 bytes.
Could I programatically open() and read() the filesystem device file (/dev/disk3s2) and scan each block for the data I want, saving only those blocks that match?
Seems logical, but I do not know the details.
One way to go is to de-encrypted the disk image into a file. Make a copy of the image. Use disk utility to decrypt the image.
!http://farm3.static.flickr.com/2509/3971696155_84092e9ce6.jpg1
The grep command will scan a file.
You can use dd to copy data out.
You should be about to use a hex editor like 0xED.app on the file.
Macintosh-HD -> Applications -> Utilities -> Terminal
man grep
Here is the scan on the actual folder iMac
mac $ grep -bia   'pdisk'  /Users/mac/Desktop/iMac/z-find/.bash-backup-copy-initial-dot-copy.html
2536:#It is  best to do the pdisk command before you eject the
2674:another pdisk command to see what drive name has disappeared.  The
2815:sudo pdisk -l <br>
2875:man pdisk<br>
Here is the scan on the image file:
mac $ grep -bia   'pdisk' /Users/mac/Desktop/iMac-image-rw.dmg
9894376:&amp;#035;It is  best to do the pdisk command before you eject the
9894514:another pdisk command to see what drive name has disappeared.  The
9894655:sudo pdisk -l <br>
9894715:man pdisk<br>
9925263:  450  pdisk -l
9925279:  451  sudo pdisk -l
9925300:  452  sudo pdisk -l
9928669:mac $ sudo pdisk -l
9929943:pdisk: No valid block 1 on '/dev/rdisk1'
9929984:pdisk: No valid block 1 on '/dev/rdisk3'
9930810:Library/                        fd.gz                           pdisk-log.txt
9931311:System Folder9-19-7.img         find-search-results.xls         seepdisk
10011023:command.  I am searching for the word pdisk.  The symbols {}
10011260:"&amp;lowast;bash-&amp;lowast;"  -exec grep -bilr  'pdisk' {}
11723093:searching for the word pdisk where file names containing  "bash-"
11723518:-type f -exec grep -bil 'pdisk' {} \;<br>
13543912:&amp;#035;It is  best to do the pdisk command before you eject the
13544050:another pdisk command to see what drive name has disappeared.  The
13544191:sudo pdisk -l <br>
13544251:man pdisk<br>
13617640:&amp;#035;It is  best to do the pdisk command before you eject the
13617778:another pdisk command to see what drive name has disappeared.  The
13617919:sudo pdisk -l <br>
13617979:man pdisk<br>
13703656:&amp;#035;It is  best to do the pdisk command before you eject the
13703794:another pdisk command to see what drive name has disappeared.  The
13703935:sudo pdisk -l <br>
13703995:man pdisk<br>
13769192:&amp;#035;It is  best to do the pdisk command before you eject the
13769330:another pdisk command to see what drive name has disappeared.  The
13769471:sudo pdisk -l <br>
13769531:man pdisk<br>
13851112:&amp;#035;It is  best to do the pdisk command before you eject the
13851250:another pdisk command to see what drive name has disappeared.  The
13851391:sudo pdisk -l <br>
13851451:man pdisk<br>
mac $