3

After a scan disk i have a lot of CHK-files in folders like "found.000", ...

I can find out the extensions with the file command:

for i in /media/Daten/found.*/*.chk ; do file $i; done

how can I use this to reconstruct all file extensions to these files?

rubo77
  • 19,527
  • 31
  • 134
  • 226

2 Answers2

8

This technique WILL NOT WORK FOR ALL FILES. I used to use this to help with data recovery.

for i in /media/Daten/found.*/*.chk; do mv "$i" "$i".$(grep $(file -bi $i | awk '{print $1}' | sed 's/;//') /etc/mime.types | head -1 | awk '{print $2}'); done

The way this works is it uses the mime type functionality in the file command then greps /etc/mime.types for it, picks the first extension in the list and then renames the file to that.

This command will do mass renames, it will move first and ask questions later, so be 100% sure you're running this on the correct directory.

Next time, do not use chkdsk to recover files. You can damage them beyond repair. chkdsk will OM NOM NOM your data and burp afterwards. Always use recovery software to get back the files you need before you chkdsk.

Generally, the files are named .CHK though, not .chk (just fyi.)

OmnipotentEntity
  • 16,531
  • 6
  • 62
  • 96
  • thx, that worked. but can you somehow not rename files, if there is no extension found? and exclude directories too? – rubo77 Jun 05 '12 at 03:39
  • I've given you all of the tools to fix this job. What you're asking about is trivial to implement. Research the `bash` if statement. Together, with my solution laid out on a platter, and your research into how to tweak it, we can work together and build you the exact solution you want. – OmnipotentEntity Jun 05 '12 at 03:46
  • ok, maybe i'll find out how to change exe extensions then to ".exe" instead of ".bin". but for a start this already works fine to me. thx ;) – rubo77 Jun 05 '12 at 03:48
  • This worked for me, however it retained the .CHK in the filenames with the added extension. To fix this I changed the following part of the command: do mv "$i" "${i%.CHK}" – Robert James Mieta Nov 09 '19 at 06:22
3

To recover specific file types, first see what's there. Tested on OS X:

file --mime -b /media/Daten/FOUND.*/*.CHK | sort | uniq

application/octet-stream; charset=binary
application/ogg; charset=binary
application/pdf; charset=binary
application/zip; charset=binary
audio/x-wav; charset=binary
image/jpeg; charset=binary
image/png; charset=binary
video/3gpp; charset=binary

Then, for the types you want to keep:

mkdir /tmp/renamed

for f in /media/Daten/FOUND.*/*.CHK
do file --mime $f \
  | perl -n -e \
  '/^([^.]*).*(3gpp|jpeg|ogg|png|wav)/ && print "$1.CHK /tmp/renamed/$1.$2\n"' \
  | xargs cp
done

This uses file --mime (or file -I, or file -i on Linux) to determine the MIME type, then passes the line with both the filename and the MIME type to Perl, which uses a regular expression to capture the base name (like FILE0001) and the file type (like jpeg) and prints a line like FILE0001.CHK /tmp/renamed/FILE0001.jpeg. Finally, that line is passed to cp.

(The \ continues a single-line command on the next line.)

Arjan
  • 22,808
  • 11
  • 61
  • 71
  • cool thx, but should be a small i letter: file -ib /media/Daten/found.00*/*.* | sort | uniq; this part works, but the rest i cannot run on ubuntu – rubo77 Jul 22 '12 at 11:41
  • Ah, not on OS X: *-i If the file is a regular file, do not classify its contents* versus *-I, --mime Causes the file command to output mime type strings*. Funny people. I'll change to `--mime` then! – Arjan Jul 22 '12 at 12:07
  • Any error message for the other parts? Maybe making it one line (with some semi-colons) helps? – Arjan Jul 22 '12 at 12:10