Recover just deleted scanned pdf without unmounting

data-recoverypdf

I have just deleted a scanned pdf file.

I'm trying to recover it with scalpel.

The problem is that scalpel will recover many deleted files and
names them numerically (e.g. 0001.pdf, 0002.pdf, … 9999.pdf).

According to this tutorial I could use a grep command and search
some text in the deleted file.

The problem is, that the file is scanned (I know the original file name),
so I don't know what to search for.

Best Answer

If you can scan the document again, you might be able to automatically compare that against the recovered documents. But if that is the case you probably don't need to recover.

That leaves finding the right PDF, and since opening them one by one in programs like evince is cumbersome I recommend you run the following in the directory where the .pdf files are recovered:

for i in *.pdf ; do
  pdfimages -j -l 1 "$i" "${i%}"
done

This will leave with JPEG files (-j option, unless the scanned file was not JPEG, which is unlikely) with the first page ( -l 1 ) with same basename as your PDFs.

Now you can use eog to quickly browse through the extracted images until you (visually) recognise the document you are looking for. Once found the image file will have the same basename as the PDF file you are looking for.

Related Question