RecoverPy
by PabloLec
RecoverPy is a Linux terminal tool that interactively finds and recovers deleted or overwritten files by scanning disk blocks.
Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal
Primary Use Case
RecoverPy is designed for Linux users who need to recover lost data from their partitions, including files that have been deleted or overwritten. Incident responders, forensic analysts, and system administrators can use this tool to quickly locate and restore important files by searching file contents directly on disk blocks.
- Recover overwritten and deleted files
- Search file contents by string, including binary files
- Interactive, modern terminal user interface
- Supports all Linux file systems
- Fast scanning leveraging core Linux utilities (grep, dd, lsblk)
Installation
- Install required tools: grep, coreutils, util-linux, and optionally progress
- For Debian/Ubuntu: sudo apt install grep coreutils util-linux progress
- For Arch: sudo pacman -S grep coreutils util-linux progress
- For Fedora: sudo dnf install grep coreutils util-linux progress
- Run without installation using pipx: sudo pipx run recoverpy
- Run without installation using uvx: sudo uvx recoverpy
- Install from PyPI: python3 -m pip install recoverpy
- Run the tool with root privileges: sudo recoverpy
Usage
>_ sudo recoverpyLaunch RecoverPy with root privileges to start the interactive recovery process.
>_ Select partitionChoose the Linux partition where the lost data is located for scanning.
>_ Search content by stringEnter a unique string from the lost file to scan disk blocks and locate matching data.
>_ Preview and recoverInteractively preview found blocks and save recovered files; explore adjacent blocks if needed.
- Integrate RecoverPy into incident response playbooks to accelerate forensic data recovery during investigations.
- Use RecoverPy in blue team exercises to simulate recovery from ransomware or data deletion attacks.
- Combine RecoverPy with disk imaging tools to create a robust forensic workflow for evidence preservation.
- Automate scanning and recovery tasks with scripting to reduce manual effort during high-pressure incidents.
- Leverage RecoverPy’s interactive search to train analysts on identifying overwritten or deleted artifacts in complex investigations.
Docs Take 2 Hours. AI Takes 10 Seconds.
Ask anything about RecoverPy. Installation? Config? Troubleshooting? Get answers trained on real docs and GitHub issues—not generic ChatGPT fluff.
This tool hasn't been indexed yet. Request indexing to enable AI chat.
Admin will review your request within 24 hours
Related Tools
mvt
mvt-project/mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
post-mortems
danluu/post-mortems
A collection of postmortems. Sorry for the delay in merging PRs!
Detect-It-Easy
horsicq/Detect-It-Easy
Program for determining types of files for Windows, Linux and MacOS.
howtheysre
upgundecha/howtheysre
A curated collection of publicly available resources on how technology and tech-savvy organizations around the world practice Site Reliability Engineering (SRE)
awesome-incident-response
meirwah/awesome-incident-response
A curated list of tools for incident response
chainsaw
WithSecureLabs/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts