Reconstructing files with Magic Rescue

Flash memory media have largely replaced CDs and DVDs; yet, the popular USB sticks and SD cards have their disadvantages. If you remove them from the computer without first unmounting them cleanly, you often get inconsistencies that make the data unreadable. With Linux and the Magic Rescue tool, however, you can rescue your data in many cases.

Magic Numbers

Unlike many conventional tools, Magic Rescue [1] doesn't depend on the mapping tables of the filesystem to do its work. Instead, it uses "magic numbers" of the different file types. The software can do its job even when partitions have corrupted file allocation tables that can no longer be reconstructed with any certainty.

The so-called magic numbers that Magic Rescue uses for data reconstruction exist in almost all files in the header data before the payload data and labels. These magic numbers are in a standardized format for each file type.

Most applications identify the data type from the magic number to decide if they can even open the file or support its file type, something that works despite the filename extension.

How It Works

Magic Rescue can thus help in cases where the damaged partition is corrupted and cannot be directly accessed on the storage media.

The software reads all sectors of a block device and compares the data with the magic numbers of the searched file types. If it finds matches, it copies the relevant sector and its continuing sectors to another storage media and reconstructs the files.

Magic Rescue supports a variety of file types that range from AVI files through MP3 audio to Zip archives. The software can also integrate metadata in the scan. Thus you can scan JPEG files that have Exif metadata from a digital camera just as easily as JPEG files without the metadata.

Magic Rescue extracts so-called "recipes" from the file format types that serve as templates and parameters for command entries in the terminal. In Ubuntu, these restorative recipes are likely in the magicrescue/recipes/ directory under /usr/share/ . Because recipes are simple text files, you can create new ones with a simple text editor (Figure 1).

Figure 1: A simple recipe for reconstructing PNG files.