I'm currently trying to find a file that was hidden in sector 2047. My root partition starts at sector 2048.
How would I go about finding that file? Given the only info I have is the sector its in.
Thanks in advance!
There's no file hidden in sector 2047. There may be data, but it's not part of the file system.
To recover it:
- Figure out sector size of disk
- Read sector with e.g.
Figure out sector size
sudo fdisk -l will show you sector sizes:
$ sudo fdisk -l [sudo] password for root: Disk /dev/sda: 238.5 GiB, 256060514304 bytes, 500118192 sectors Disk model: SAMSUNG MZ7TY256 Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: gpt
Here we have 512B sectors. This is probably the most common; some newer devices will have 4KB sector sizes. This is the reason we need to know the sector size of the device - we have to specify it in the next step, so
dd knows how many bytes to skip.
Read out said sector
dd can do for us.
sudo dd if=/dev/sda of=sector2047 bs=512 skip=2046 count=1
ddto read from
ddto write to the file
ddto read in 512B increments (block size)
ddto skip first 2046 512B-blocks
ddto read 1 block of 512B.