Web Interface

Web interface

The web interface is the primary way to drive the engine. Start it with ghost_recover (no command) — it opens your browser at http://127.0.0.1:3030 by default.

The console follows a three-step workflow: Source → Volume → Recover, with a progress bar that reports honest byte- and candidate-based percentages for every long operation.

Boot screen

• The GHOST RECOVER logo, engine version and a summary of the running engine (filesystems, carver signatures, output root).
• Start recovery — begin the three-step workflow.
• 🔒 Unlock disk access — elevate to root so physical disks become readable (see Elevation and security).
• Engine status dots and a live log drawer.

Step 1 — Source

Pick a physical disk, or open a disk image (.img, .dd, .raw, .iso, .vmdk). Everything is opened read-only.

• Physical disks show name, size and filesystem; locked disks display an Unlock hint.
• Rescan devices — refresh the device list.
• Open image file… — attach an image via the built-in file browser.
• Assemble a RAID array… — rebuild an array from member images.

Step 2 — Volume

Once a source is attached you see its partitions, each with filesystem, size, offset and deleted-partition detection. Select a volume (or the whole disk) and choose:

Action	What it does
Scan filesystem	reads the volume's own metadata and lists files, including deleted ones
Carve signatures…	ignores metadata and finds files by their content — works even when the filesystem is destroyed
Deep recovery	does both and merges the results
Recover files…	scan and write every recoverable file to the output root
Repair…	dry-run repair of a damaged boot region or GPT header (needs --allow-writes to apply)
Clone…	image the whole device, tolerating bad sectors

Step 3 — Recover (results)

The results screen shows:

• Filter bar — search by name, filter by extension and by state (everything / deleted only / existing only), and a per-category summary (e.g. jpg (12), pdf (3)).
• Sortable table — name, path, size, modified time, state (deleted/existing), confidence and recovery method (scan or carve:format).
• Pagination — page through large result sets.
• Preview pane — images, audio and video play directly in the page; PDFs render in an iframe; unknown formats fall back to a hex viewer. Previewing reads straight from the volume — nothing is written until you choose to recover.
• Recover files… — pick files (or all) and write them to a directory under the output root.

Other controls

• Log — the engine's live log drawer (info / warn / error entries).
• Shut down — stop the engine cleanly.
• The privacy rule: nothing is ever written back to the source device; recovered files go only to the output directory.