Binary package “magicrescue” in ubuntu xenial
recovers files by looking for magic bytes
Magic Rescue scans a block device for file types it knows how to recover
and calls an external program to extract them. It looks at "magic bytes"
in file contents, so it can be used both as an undelete utility and for
recovering a corrupted drive or partition. As long as the file data is
there, it will find it.
.
Magic Rescue uses files called 'recipes'. These files have strings and
commands to identify and extract data from devices or forensics images.
So, you can write your own recipes. Currently, there are these recipes:
.
* avi
* canon-cr2
* elf
* flac
* gimp-xcf
* gpl
* gzip
* jpeg-exif
* jpeg-jfif
* mbox
* mbox-mozilla-inbox
* mbox-mozilla-sent
* mp3-id3v1
* mp3-id3v2
* msoffice
* nikon-raw
* perl
* png
* ppm
* sqlite
* zip
.
This program is useful in forensics investigations.