Command Line Tool

Command-line tool

ghost_recover runs in two modes: it starts the web interface when called with no command, or executes a headless command and prints the result to the terminal.

ghost_recover [options]                     start the web interface
ghost_recover <command> [args]              run headlessly

Server options

Option	Description
--port N	listen on port N (default 3030)
--listen ADDR	bind address (default 127.0.0.1; use 0.0.0.0 to expose)
--output DIR	where recovered files are written (default $GHOST_OUTPUT or ~/ghost-recover-output)
--allow-writes	permit repair operations to modify the device
--no-browser	do not open a browser window
--web DIR	path to the web assets
--takeover FILE	internal: claim the port from a running instance

Commands

Command	Purpose
disks	list block devices
detect <device|image> [--offset N]	identify the filesystem
parts <device|image> [--deep]	list partitions (--deep finds deleted ones)
scan <device|image> [options]	list files, including deleted ones
carve <device|image> [options]	signature-carve into --out DIR
recover <device|image> --out DIR	scan and write every recoverable file
image <device> --out FILE	clone to an image, tolerating bad sectors
raid <member> ... [--out FILE]	detect RAID parameters, optionally assemble (use missing for a dead member; --level/--chunk/--layout state a geometry instead of detecting it)
repair <device|image> [--action A] [--apply]	repair a damaged filesystem
carvers	list carver signatures

Common options

Option	Description
--offset N	start of the volume inside the device, in bytes
--size N	length of the volume, in bytes
--fs NAME	force a filesystem instead of auto-detecting
--out DIR	output directory or file
--limit N	show at most N rows (default 200)
--max-files N	stop scanning after N files
--deleted	only report deleted files
--json	machine-readable output

Examples

ghost_recover                                  # open the GUI

sudo ghost_recover parts /dev/sda --deep      # partitions, incl. deleted ones
sudo ghost_recover scan /dev/sda2 --deleted   # list deleted files
sudo ghost_recover recover /dev/sda2 --out ~/rescued
sudo ghost_recover carve /dev/sda2 --out ~/carved --categories image,document
sudo ghost_recover image /dev/sdb --out ~/sdb.img     # clone a failing drive
     ghost_recover raid m0.img m1.img m2.img --out ~/array.img

Recovered files go to $GHOST_OUTPUT, or ~/ghost-recover-output.