undelete

#!/bin/bash
# It is a wrapper for ntfsundelete utility. It may be useful if you want to
# restore only specified filetypes (zip, 7z and Logic Audio Song in my case) but
# names of accidentally deleted files are lost

# Globals ======================================================================
DEVICE=/dev/sdb1        # device
DEST=/media/recover     # destination
TMP=/dev/shm            # temp directory
HEAD_ZIP="504b0304"     # 4 bytes in HEX
HEAD_LSO="1347c0ab"     # 4 bytes in HEX
HEAD_7Z="377abcaf"      # 4 bytes in HEX


# Script =======================================================================
cd $TMP
# Get inodes of potentially restorable files
ntfsundelete $DEVICE -p 100 -S 512-100m | grep -o -e ^[0-9]* > inodes.txt

# Define format file for hexdump
echo "16/1 \"%02x\"" > printformat

# get whole number of inodes
num_inodes=$(wc -l inodes.txt | grep -o -e ^[0-9]*)

# Cycle through all inodes
for (( i=1; i<=$num_inodes; i++ ))
do
# Get current inode by it's number
    inode=$(sed -n "$i p" inodes.txt)

# Undelete file
    ntfsundelete $DEVICE -u -i $inode > /dev/null

# Check filetype and make decision
    HEAD4="$(hexdump -f printformat -n 4 unknown)"
    if   [ $HEAD4 = $HEAD_ZIP ]; then
        echo "$HEAD4 ZIP found"
        mv unknown $DEST/$inode.zip
        chmod 666 $DEST/$inode.zip
    elif [ $HEAD4 = $HEAD_LSO ]; then
        echo "$HEAD4 LSO found"
        mv unknown $DEST/$inode.lso
        chmod 666 $DEST/$inode.lso
    elif [ $HEAD4 = $HEAD_7Z ]; then
        echo "$HEAD4 7-Zip found"
        mv unknown $DEST/$inode.7z
        chmod 666 $DEST/$inode.7z
    else
        rm unknown
    fi
done