-1

Can anyone suggest how I can configure Scalpel to recover an R file on Ubuntu 14.04 machine?

I absolutely need to do this .

My problem is - the scalpel config file does not have an entry for R files and I cannot figure out how to add one, especially the header and footer part.

R.S.
  • 2,093
  • 14
  • 29

2 Answers2

3

OK, I did as Neef had suggested, with some modification. My effort was far from perfect , but here it is for reference for anyone who requires to do this in future :

  • Edited scalpel config file

    gksudo gedit /etc/scalpel/scalpel.conf

Added this line to it:

R   n   60000   read.csv

It basically seems to tell scalpel to look for 60 kb blocks starting with the text read.csv . ( I knew my file to have read.csv near top so used it as a pseudo header of my R files ) Similarly, I Did not supply any footer as there is no definite end marking on the plain text source code files.

  • Ran scalpel :

    sudo scalpel -o recovered_myRfiles /dev/sda6

It took 2500 secs to work for the 98 GB partition and created the directory ./recovered_myRfiles and dumped a number of R files to it.

  • It had gleaned all sorts of files pieces which started with read.csv and dumped them into numbered files with .R extension, each 50 kbs in size. Some were R files, some html and some other sorts of documentation. I had to do a find to figure out if my file was amongst them.

Hope this helps someone in future. Please comment to add improvements. And many thanks, berf for clarifying the bits and pointing me to the relevant section of that article. Can't accept is as a working answer but highly appreciated.

R.S.
  • 2,093
  • 14
  • 29
2

Scalpel looks for specific headers/footers, since R files are plain text there is no fixed header or footer. But you might create a custom signature, something like (assuming most R files have a Library statement somewhere in the first 20 characters):

R y 300:50000 /%.{1,20}\.ibrary/ /%.{1,20}\.\sEnd/

might work.

Based on the TeX example from http://www.linux-magazine.com/Online/Features/Recovering-Deleted-Files-with-Scalpel

Bert Neef
  • 743
  • 1
  • 7
  • 14
  • Given that regex it will search for a file starting with percent sign and ending with a space and End..However, I think you have pointed me in the right direction. R creates a session for every session , so I might be able to guess what commands were at the beginning of that file... Let me give it a spin – R.S. Nov 11 '15 at 11:36
  • Hopefully it gets you something usable, I did a very quick attempt to modify the TeX example. – Bert Neef Nov 11 '15 at 12:00