Find bytes from a file and/or an Unicode stringAn additional debug/search feature is to find bytes from a file and/or Unicode strings. -ff and -fi can be used with the same command. hfsprescue --find <device node|image file> [-ff <num bytes> <file1> [file2] [...]] [-fs <string>] [-o <offset in bytes>] • Find bytes of one or more files -ff You can find the bytes of a file. This can be very useful when you lost the partition table and you have to calculate the offset of the partition. It makes no sense to search for the whole file. It can be fragmented and you will never get a hit. The file size of the source file is not limited by hfsprescue. Regardless to the file size is the maximum search buffer size 1MB. This this is really large. I suggest to use the block size as maximum search length. The result of the search will be logged in the file 'hfsprescue-data/find.log'. When you use '-o <offset in bytes>' then the search begins at the offset and skips the bytes before. Find bytes example 1:
Find bytes example 2: Multiple files
• Find string -fs This can be used to find an Unicode string. File names are encoded in Unicode. Its possible to find directory entries with this feature. The search string will be converted to Unicode by hfsprescue. The result of the search will be logged in the file 'hfsprescue-data/find.log'. When you use '-o <offset in bytes>' then the search begins at the offset and skips the bytes before. Find string example:
© 2024 by
Elmar Hanlhofer |