Let's say I have an unmounted block device /dev/sda, and I want to replace all instances of MyPassWord with XXXXXXXXXX. (Hopefully my goal is obvious.)
What's the easiest way to do this?
-
1If you are going to replace on the block level I would make sure that the patterns are of equal length (now it is 10 resp. 12 characters). Whatever technique you are going to use.Anthon– Anthon2015-01-21 16:13:42 +00:00Commented Jan 21, 2015 at 16:13
-
1How big is the block device? "Easiest" could be to copy it to a file on another block device and then use 'sed'. But it would be very slow. Most efficient way would be to write a quick C program, but writing C isn't everyone's idea of easy.dataless– dataless2015-01-21 16:21:05 +00:00Commented Jan 21, 2015 at 16:21
-
4Also keep in mind that if your password is split between two blocks of a file, those blocks might not be adjacent on the disk. So you might not find all occurrences.dataless– dataless2015-01-21 16:22:02 +00:00Commented Jan 21, 2015 at 16:22
-
@Anthon: Oops, yes I meant to assume that, I counted my X's wrong.Jay Sullivan– Jay Sullivan2015-01-21 16:24:02 +00:00Commented Jan 21, 2015 at 16:24
-
1@Anthon I think you misunderstood me; the filesystem is not guaranteed to put two adjacent file chunks on adjacent device blocks. So its possible to have a file still containing the password even if the complete string doesn't exist anywhere on the block device.dataless– dataless2015-01-21 21:07:05 +00:00Commented Jan 21, 2015 at 21:07
|
Show 7 more comments
1 Answer
You can do something like:
#! /usr/bin/env python
device = '/dev/sdi'
old_pattern = "MyPassWord"
new_pattern = "XXXXXXXXXX"
assert len (old_pattern) == len(new_pattern)
BS = 1024 ** 2 # 1 Mb buffer
# read a few bytes more to account for occurences of the pattern on the edge
READSIZE = BS + len(old_pattern)
offset = 0
with open(device, 'r+b') as fp:
assert isinstance(fp, file)
while True:
try:
fp.seek(offset)
except IOError:
#print 'offset', offset
#raise
break
buf = fp.read(READSIZE)
occurences = buf.count(old_pattern)
if occurences:
print offset, occurences
fp.seek(offset)
fp.write(buf.replace(old_pattern, new_pattern))
fp.flush()
offset += BS
substituting the appropriate device name at the top.
You have to run the script as root and make sure you re-mount the device when finished as the system buffers of file contents are not notified of the changes.
-
Hmm...I think this will fail to find
MyPassWordif it falls any 1Mb boundary. +1 thoughJay Sullivan– Jay Sullivan2015-01-21 20:08:51 +00:00Commented Jan 21, 2015 at 20:08 -
1@notfed No it won't. I read (and write if applicable) READSIZE which is len(old_pattern) longer than BS, but I step by BS. The next read reloads a few bytes of the previous processAnthon– Anthon2015-01-21 20:20:01 +00:00Commented Jan 21, 2015 at 20:20
-
1@notfed There is still the problem, as dataless correctly pointed out (and for which I needed extra clarification) that if
MyPassWordis in a file and the blocks that hold the date of that file are not next to each other in the file, then this won't work. In that case you would need to scan each and every file through the filesystem, and do the same for deleted file that might be recovered (e.g. withextundelete)Anthon– Anthon2015-01-21 21:12:53 +00:00Commented Jan 21, 2015 at 21:12