recovery PDF files with GREP - Notes for tutorial

#See if you can find the file
sudo grep “Android” /dev/sdc1
sudo grep -a "Xorg on Android" /dev/sdc1

#pull the files and other things around it
#if it’s a large file increase -B and -A
sudo grep -a -B 10000 -A 10000 "Xorg on Android" /dev/sdc1 > recovery.img

#glance at what you’ve got
strings recovery.img

#check and see if you’ve got the PDF header and footer
#if not increase -B and -A and try again
grep -a -e '%PDF' -e '%%EOF' recovery.img

#recover file
sed -n '/%PDF/,/%%EOF/p' recovery.img > recovered.pdf


#notes
#**** Warning: File has some garbage before %PDF- .
head recovered.pdf
sed -i 's/        self.projectfile //' recovered.pdf

#”        self.projectfile “ being what you found before ‘%PDF’ with ‘head’