RecoverPy

RecoverPy scans raw partitions or disk images by reading the block device’s byte stream directly, looking for user‑provided byte patterns. It opens the selected partition in read‑only mode, processes the data in fixed‑size chunks with overlapping windows, and records the absolute offsets of any matches. Users can then inspect the matching blocks, move across adjacent blocks, and save any recovered fragments, without relying on filesystem metadata or attempting to reconstruct full files.

The tool is aimed at users who need to retrieve overwritten or deleted data on Linux systems, such as forensic analysts, system administrators, or anyone facing accidental loss of files. It works from the command line, requires Python 3.9+ and typically sudo privileges to access raw block devices, and operates with a streaming, memory‑bounded approach that never loads an entire partition into RAM.

RecoverPy does not interpret filesystem structures or restore original filenames; it simply exposes the remaining byte content that has not been overwritten. Its functionality is limited to cases where the underlying disk blocks are still intact, and it is not designed for automatic file reconstruction.