Python and lost files

[Timothy W. Grove]

Recently I purchased some software to recover some files which I had
lost. (A python project, incidentally! Yes, I should have kept better
backups!) They were nowhere to found in the file system, nor in the
recycle bin, but this software was able to locate them and restore them.
I was just wondering if there was a way using python to view and recover
files from the hard drive which would otherwise remain lost forever?

Best regards,
Tim

 

[lallous]

Hello Timothy,

Recently I purchased some software to recover some files which I had lost.
(A python project, incidentally! Yes, I should have kept better backups!)
They were nowhere to found in the file system, nor in the recycle bin, but
this software was able to locate them and restore them. I was just
wondering if there was a way using python to view and recover files from
the hard drive which would otherwise remain lost forever?

To recover lost or deleted files you need a specialized tools (such as data
recovery programs).
I don't see a way to recover files using python itself but perhaps using a
data recovery program written in Python.

 

[alex23]

I was just wondering if there was a way using python to view and recover
files from the hard drive which would otherwise remain lost forever?

I'm not familiar with any Python-based tools for data recovery, but
you might be interested in mercurial[1], which _is_ (primarily)
written in Python

1: http://mercurial.selenic.com/

 

[Carl Banks]

Recently I purchased some software to recover some files which I had
lost. (A python project, incidentally! Yes, I should have kept better
backups!) They were nowhere to found in the file system, nor in the
recycle bin, but this software was able to locate them and restore them.

I could have used that yesterday, if it were able to work for a
network Samba drive. (Yeah, not likely.)

I was just wondering if there was a way using python to view and recover
files from the hard drive which would otherwise remain lost forever?

Obviously, if that program was able to do it, it's possible.

On Unix-like OSes, and probably others, it's possible to read the raw
data on a disk the same way as you would read any file. So Python can
do it without any system-level programming. Recent versions (I think
2.6+) can use mmap, too, now that it supports an offset parameter.

I don't think you can do that in Windows, though. I think you'd have
to use special system calls (via ctypes, for example).


Carl Banks

 

[Grant Edwards]

Recently I purchased some software to recover some files which
I had lost. (A python project, incidentally! Yes, I should
have kept better backups!) They were nowhere to found in the
file system, nor in the recycle bin, but this software was
able to locate them and restore them. I was just wondering if
there was a way using python to view and recover files from
the hard drive which would otherwise remain lost forever?

Yes, you could write a filesystem analysis and file recovery
program in Python. [I guess that's what you were asking.]

 

[Dave Angel]

I could have used that yesterday, if it were able to work for a
network Samba drive. (Yeah, not likely.)




Obviously, if that program was able to do it, it's possible.

On Unix-like OSes, and probably others, it's possible to read the raw
data on a disk the same way as you would read any file. So Python can
do it without any system-level programming. Recent versions (I think
2.6+) can use mmap, too, now that it supports an offset parameter.

I don't think you can do that in Windows, though. I think you'd have
to use special system calls (via ctypes, for example).


Carl Banks

To write such a program, you have two challenges. First is to get
read-access to the raw sectors of the partition, and second, to analyze
them to discover which ones are interesting, and how they need to be
combined to reconstruct the lost data.

In Windows, the first challenge is pretty easy for drives other than the
system drive (usually drive C:, but not necessarily.) You use one of
the following:
\\.\X: where X: is the logical drive letter
or \\.\PhysicalDriveN where N is the hard drive # (0, 1, 2...)
Normally you'd use this only if the data is on a "deleted" or "foreign"
partition that Windows doesn't recognize.

Naturally, make sure the scratch files and result files you create are
going to a different partition/drive.

The second challenge is the file system format. If you go with physical
drive, you'll have to parse the partitioning information to find
individual partitions within the drive, and once you get to a partition,
you have to parse the particular file system. Most likely NTFS (which
has had several versions). But could be FAT32, FAT16, or a couple of
other less likely candidates.

While you can also do this for a system partition, there are some
challenges that I've no relevant experience with.

DaveA