如何使用 foremost 恢复已删除的文件

Question

我进入了错误的文件夹并删除了一系列非常重要的 python 文件！我该如何在 foremost 中配置规则来恢复它们？并使用 Debian OS

/etc/foremost.conf

 CONFIGURATION FILE
              The configuration file is used to control what types  of
              files  foremost  searches  for.  A  sample configuration
              file, foremost.conf, is included with this distribution.
              For each file type, the configuration file describes the
              file’s extension, whether the header and footer are case
              sensitive,  the  maximum  file  size, and the header and
              footer for the file. The footer field is  optional,  but
              header, size, case sensitivity, and extension are not!

              Any  line  that begins with a pound sign is considered a
              comment and ignored. Thus, to skip a file type just  put
              a pound sign at the beginning of that line

              Headers and footers are decoded before use. To specify a
              value in hexadecimal use \x[0-f][0-f], and for octal use
              \[1-9][1-9][1-9].   Spaces  can  be  represented  by \s.
              Example: "\x4F\123\I\sCCI" decodes to "OSI CCI".

              To match any single character (aka a wildcard) use a  ?.
              If you need to search for the ? character, you will need
              to change the wildcard line *and*  every  occurrence  of
              the old wildcard character in the configuration file. Do
              not forget those h

但文件.pypython 和.jsjavascript

Answer 1

Foremost 仅处理特定文件，例如图像和电影。

开箱即用，Foremost 无法恢复 Python 或 Javascript 文件。^1，2

但是，您可以让它发现其他文件类型，如下所述在这篇博文中。

例如，通过创建一个foremost.conf包含以下制表符分隔条目的文件：

py  y   100000     #!/usr/bin/env\spython3

您可以搜索带有后缀的 Python 文件py，区分大小写（y），在标头中查找最多 100000 字节，并搜索 shebang 行。