Flash memory media have largely replaced CDs and DVDs; yet, the popular USB sticks and SD cards have their disadvantages. If you remove them from the computer without first unmounting them cleanly, you often get inconsistencies that make the data unreadable. With Linux and the Magic Rescue tool, however, you can rescue your data in many cases.

Magic Numbers

Unlike many conventional tools, Magic Rescue [1] doesn't depend on the mapping tables of the filesystem to do its work. Instead, it uses "magic numbers" of the different file types. The software can do its job even when partitions have corrupted file allocation tables that can no longer be reconstructed with any certainty.

The so-called magic numbers that Magic Rescue uses for data reconstruction exist in almost all files in the header data before the payload data and labels. These magic numbers are in a standardized format for each file type.

Most applications identify the data type from the magic number to decide if they can even open the file or support its file type, something that works despite the filename extension.

How It Works

Magic Rescue can thus help in cases where the damaged partition is corrupted and cannot be directly accessed on the storage media.

The software reads all sectors of a block device and compares the data with the magic numbers of the searched file types. If it finds matches, it copies the relevant sector and its continuing sectors to another storage media and reconstructs the files.

Magic Rescue supports a variety of file types that range from AVI files through MP3 audio to Zip archives. The software can also integrate metadata in the scan. Thus you can scan JPEG files that have Exif metadata from a digital camera just as easily as JPEG files without the metadata.

Magic Rescue extracts so-called "recipes" from the file format types that serve as templates and parameters for command entries in the terminal. In Ubuntu, these restorative recipes are likely in the magicrescue/recipes/ directory under /usr/share/ . Because recipes are simple text files, you can create new ones with a simple text editor (Figure 1).

Figure 1: A simple recipe for reconstructing PNG files.

To the Rescue!

Most distributions already have Magic Rescue in their repositories, which makes it easy as a rule to install this excellent utility over a graphical front end [2]. Once you have installed Magic Rescue, it's best to start by entering the magicrescue command without any further parameters to get an overview of the manageable number of options and their descriptions (Figure 2). Using multiple instances of the -r parameter, for example, you can reconstruct in a single run many different file formats.

Figure 2: Magic Rescue uses an uncomplicated syntax.

To start the scan and reconstruction, use the mkdir <folder> command to create a folder where you want the reconstructed files to go. Then, change to the recipe directory that Magic Rescue needs to access to recognize the file types and execute the following command:

$ magicrescue -r recipe_1 [...] -r recipe_n -d target_folder device

You indicate the device containing the data you want to rescue in the form of a partition on a block device, such as /dev/sdb1 or /dev/mmcblk0p1 with SD cards. If you enter a directory by mistake or just the device name, Magic Rescue will quit with an error message. (See the "Rescue Tip" for other info.)

After starting up, Magic Rescue scans the source partition and saves the scan pattern in the corresponding target directory (Figure 3). The scan results of the individual sectors can themselves be stored on quick-access Flash media, but this can take some time depending on the size of the disk. That's why Magic Rescue is less applicable for reconstructing files on large hard disks or SSD partitions.

Figure 3: Magic Rescue keeps you informed of the processing status.

Magicsort

If you use multiple instances of the -r parameter for various file types during reconstruction, Magic Rescue saves them all in the target directory. Because Magic Rescue might be reconstructing huge amounts of files, the dataset can quickly become unrecognizable.

With help from the Magicsort program [3] that comes with Magic Rescue, however, you can sort the files by type after a successful reconstruction. Use the magicsort <target_directory> command. Magicsort creates a separate subdirectory for each file type and sorts the files accordingly.

Conclusion

With the help of the little Magic Rescue tool, you can reconstruct files even with a corrupted partition. The program is reliable in that it doesn't depend on mapping tables (that are often corrupted or damaged themselves); instead, it scans the disk by sector and looks for the magic numbers in the individual blocks. The software is useful for Flash media, such as USB sticks and SD cards, that can easily become corrupted from an unclean unmounting.