Finding a bzip2 file on a damaged hard drive

James Clawson jclawsonx at
Thu Apr 7 22:20:53 MDT 2005

I am recovering data from hard drives which were part of a damaged  
RAID-5 disk array.  I used dd to image the drives, and am now  
searching these images for files.  There are three archives on these  
drives which contain all of the relevant data I need to recover.   
Using a hex editor, I have opened several known valid bzip2  
compressed files in an effort to find common bytes in the files so  
that I may identify the bzip2 files on the raw disk images.  I see  
that the files all begin with the same 10 HEX values - 0x42, 0x5A,  
0x68, 0x39, 0x31, 0x41, 0x59, 0x26, 0x53, 0x59.  Using this  
information, I have identified the address of each of the three files  
in the disk images.  However, I do not know how to identify the end  
of each file.  Can you give me any information or suggestion on how I  
might find out how long each bzip2 file should be?

The RAID partition was  not fragmented.  I have been able to extract  
word perfect and other files with well known file format markers.  I  
believe that the physical data on each disk image is intact.


More information about the PLUG mailing list