I am using currently photorec, testdisk etc. for recovering files on a lost partition. My questions:
- the files dumped by photorec have filenames like fnnnnnnn_pidxxx.txt. Is now the number after the “f” the on-disk block number on on-disk-byteposition, cluster number etc?
- If I extract by substr func this number - in case of on-disk block number - I can access directly the data by hexeditor or hexdump etc. isn’t it?
- Is there any possibility to get back by these numbers to the directory inode or other inode structs?
- Can I use a linux strings | grep -i “filename” or grep -i “some id string” to get e.g. a byte pos/block pos of file and then get back to the inodes
- In e.g. Amiga filesystem (that Commoder 1980’s home computer) there was a 4 byte ID “DIR\0” etc. for eacht on disk structures. That made recovery much more easier. Why does not Linux (the ext2 filesystem developers) do that?
Thanks for serious answers