Recovering/undeleting short deleted files in 50 SLOC of pure C, any filesystem supported.

Be very careful when disposing your HDDs and SSDs.

This is a real story.

Once I accidentally deleted my very important SSH private key. I wrote a short utility that just scans my SSD (Linux ext4 filesystem) to find a data between the "-----BEGIN OPENSSH PRIVATE KEY-----" and "-----END OPENSSH PRIVATE KEY-----" strings.

Here is it.

Run it as root:

$ sudo ./recover /dev/sda

One is found:

sudo dd if=/dev/sda count=4096 bs=1 skip=47305334784 | xxd -g 4096

00000000: 2d2d2d2d2d424547494e204f50454e53  -----BEGIN OPENS
00000010: 53482050524956415445204b45592d2d  SH PRIVATE KEY--
00000020: 2d2d2d0a6233426c626e4e7a61433172  ---.b3BlbnNzaC1r
00000030: 5a586b74646a45414141414142473576  ZXktdjEAAAAABG5v
00000040: 626d554141414145626d39755a514141  bmUAAAAEbm9uZQAA
00000050: 4141414141414142414141426c774141  AAAAAAABAAABlwAA
...[censored]...
000009e0: 7a6a4230597341414141496155426961  zjB0YsAAAAIaUBia
000009f0: 5764696233674241674d3d0a2d2d2d2d  Wdib3gBAgM=.----
00000a00: 2d454e44204f50454e53534820505249  -END OPENSSH PRI
00000a10: 56415445204b45592d2d2d2d2d0a0000  VATE KEY-----...
...

This is a real key:

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA0N2NY5z3YBBbEghV3OUW++NknPTEt2zTVPhK+yCnln8B8rYtn4QT
...[censored]...
yR2Tgq87ozNTONPYZZp88s1B+4jR5mnCS7OmasF090WEiIsS7qgx/0zMs+hg2tfec66I2z
m1jPHCUzjB0YsAAAAIaUBiaWdib3gBAgM=
-----END OPENSSH PRIVATE KEY-----

This tiny utility can also scan VM images. Or VM RAM save file.

It will also dump not deleted files. Also, chunks from openssh library. It can even find parts of the executable file of this util, because it contains these two strings.

Of course, deleted bitcoin's wallet.dat can be easily recovered as well - search for SQLite header. Or old wallet.dat (in Berkeley DB format).

Any (relatively small) (unfragmented) deleted file with known header can be recovered.

To protect from this --- use utilities like shred to delete files. And/or use encryption feature of your filesystem. And of course, a HDD/SDD must be wiped several times before disposing or throwing away or selling.

(the post first published at 20251014.)


List of my other blog posts.

Subscribe to my news feed,

Some time ago (before 24-Mar-2025) there was Disqus JS script for comments. I dropped it --- it was so motley, distracting, animated, with too much ads. I never liked it. Also, comments didn"t appeared correctly (Disqus was buggy). Also, my blog is too chamberlike --- not many people write comments here. So I decided to switch to the model I once had at least in 2020 --- send me your comments by email (don"t forget to include URL to this blog post) and I"ll copy&paste it here manually.

Let"s party like it"s ~1993-1996, in this ultimate, radical and uncompromisingly primitive pre-web1.0-style blog and website.