1

I need to pipe a list of two delimeter separated variables to a command in BASH. I deleted my girlfriend's files from her SD card accidentally. I cloned an image of it using dd and used Sleuth Kit to recover the inode number and names of the deleted files. 

fls -d -r bckup_irmasSD1.img | awk 'gsub(/\t|.*\*/,"")' | less

This gives me an example output:

6689308:DCIM/Camera/2014-02-05 20.51.30.jpg
6689560:DCIM/Camera/2013-08-10 16.37.44.jpg
6689563:DCIM/Camera/2013-08-10 16.37.52.jpg
6689566:DCIM/Camera/2013-09-14 19.00.06.jpg
6689567:DCIM/Camera/_I966F~2.MP4
29211:Android/data/com.google.android.apps.maps/cache/_ACHE_~8.M
29298:Android/data/com.google.android.apps.maps/cache/_ACHE_~2.6
29301:Android/data/com.google.android.apps.maps/cache/cache_vts_GMM.7
29304:Android/data/com.google.android.apps.maps/cache/cache_vts_GMM.8
73224:bluetooth/DSC00360.jpg
73227:bluetooth/DSC00360_2.jpg
14728713:.downloadTemp/1616021_716182491801349_1111393555_n.mp4
14728718:.downloadTemp/1616117_10151911525912011_1690760246_n.mp4
18898441:download/1595926_47757
18898445:download/1614824_234800313358133_914357470_n.mp4
18898449:download/_24316~1.MP4

To recover a deleted file by inode number, you can use the command line tool icat:

icat -d /tmp/disk.img 18898449 > /recover/download/_24316~1.MP4

How can I pipe this cleanly to a command to recover all files?

D W
  • 2,979
  • 4
  • 34
  • 45

2 Answers2

4
fls -d -r bckup_irmasSD1.img | 
awk 'gsub(/\t|.*\*/,"")' |
while IFS=: read -r inode filename; do
  mkdir -p /recover/"${filename%/*}"
  icat -d /tmp/disk.img $inode > /recover/"$filename"
done
William Pursell
  • 204,365
  • 48
  • 270
  • 300
  • That is perfect except that I don't know how to amend it to create the directory if it doesn't exist. There is a post here: http://stackoverflow.com/questions/4906579/how-to-use-bash-to-create-a-folder-if-it-doesnt-already-exist and I hope that information can do it. I am not sure how off-hand, I am looking. – D W Feb 11 '14 at 00:24
  • `mkdir -p "$(dirname "$filename")"` – glenn jackman Feb 11 '14 at 00:32
  • 1
    I think this answer is more robust than mine. Either way, make a backup first! – andypea Feb 11 '14 at 00:46
  • +1, I prefer this, just don't like mix awk with system command. – BMW Feb 11 '14 at 00:50
2

You could use awk again to split your lines and then call your command:

fls -d -r bckup_irmasSD1.img | awk 'gsub(/\t|.*\*/,"")' > indoes.txt
awk -F: '{system("icat -d " $1 " > " #2}' inodes.txt

Make sure none of your filenames contain a : and buy your girlfriend some flowers!

andypea
  • 1,343
  • 11
  • 22