Results 1 to 10 of 10

Thread: Methods or applications for data recovering

  1. #1

    Default Methods or applications for data recovering

    I came from reading this article, and though the topic is the exact opposite, I think the spoiler the author gave at the very end of second paragraph slightly affected me... I don't know if the author is open for contact should I try to ask him...

    Point is, are there good tools/applications for data recovery on Linux?

    The author sounded as if telling that kind of information was forbidden, or the like. I know there are of course programs for Windows or even bootable to do recovery stuff, though most of them are proprietary; and probably Linux tools are efficient enough for the author to consider not wise enough to openly talk about them, or that's what I imagined...

    Thanks beforehand.

  2. #2
    Join Date
    Jun 2008
    Location
    West Yorkshire, UK
    Posts
    3,452

    Default Re: Methods or applications for data recovering

    A lot of the problems are dealt with inherently; for example, if someone pulls the plug on your laptop, as someone accidentally did to me recently, you simply reboot and ext4 will recover everything.

    Many problems can be dealt with by programs like the openSUSE recovery mode or the SuperGrub Disk but, for the Swiss Army knife of recovery tools, you can download http://www.sysresccd.org/SystemRescueCd_Homepage.

    BTW this program will also recover Windows data and it is free.
    Last edited by john_hudson; 21-Feb-2014 at 15:29. Reason: Additional information

  3. #3
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Methods or applications for data recovering

    On 2014-02-21 20:46, F style wrote:
    >
    > I came from reading 'this article' (http://tinyurl.com/k3vybcu), and
    > though the topic is the exact opposite, I think the spoiler the author
    > gave at the very end of second paragraph slightly affected me... I don't
    > know if the author is open for contact should I try to ask him...


    Sorry, I don't quite understand. language barrier, perhaps. What
    spoiler, exactly?

    > Point is, are there good tools/applications for data recovery on Linux?
    >
    > The author sounded as if telling that kind of information was forbidden,
    > or the like. I know there are of course programs for Windows or even
    > bootable to do recovery stuff, though most of them are proprietary; and
    > probably Linux tools are efficient enough for the author to consider not
    > wise enough to openly talk about them, or that's what I imagined...


    I don't understand any of that. Why would data recover tools be forbidden?

    There are tools in Linux to try recover files after accidental
    destruction, as long as the data is actually there, but not the metadata
    that allows the operating system to locate files, where a particular
    file is stored. The idea is to search the entire disk for recognizable
    file headers, and then try to recover the rest of each file, one by one.
    Photorec does quite a good job of recovering jpeg files (and some video
    files) out of a camera flash disk, for instance. Or any hard disk, for
    that matter. But it works badly at recovering about any other type of file.

    This method is called "data or file carving".

    Another good file carver is "foremost".

    On the same suite than photorec is testdisk, that does a reasonable good
    job of repairing partition damage. It would be the first thing to try.

    ext4magic can try recover some deleted files in ext4 partition.

    There are, of course, proprietary software for this, and some are pretty
    good. How they do it they keep secret, but not because illegal, but to
    avoid competitors so that they keep making money. I have used "Restorer
    Ultimate" with good results.

    However, if the disk was intentionally deleted, via overwriting all
    sectors with something else, none of those tools will recover any data
    at all. To try recover what was there you need a good forensic lab,
    money, time, and resources. What are the possibilities, nobody really
    knows, and those that really know do not talk. We guess that people on
    the NSA or the CIA can do it :-p

    (the basic idea is to read the remaining, overlapping, microscopic, and
    weak magnetic fields in the disk plates, somehow).

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  4. #4
    Join Date
    Jun 2008
    Location
    UK
    Posts
    5,500

    Default Re: Methods or applications for data recovering

    Quote Originally Posted by john_hudson View Post
    for the Swiss Army knife of recovery tools, you can download http://www.sysresccd.org/SystemRescueCd_Homepage.

    BTW this program will also recover Windows data and it is free.
    Yes, it is excellent with good documentation provided. I used it to rescue the partitions of a failing internal HDD, and recover them to a new one. That included a couple of Win 7 partitions, data and several openSUSE partitions. As well as the usual tools, particularly useful were "testdisk" to aid rescue, and "partclone" for backup/restore of used blocks (similar to "partimage" but supports ext4).
    Leap 42.3 (ext4, KDE Plasma 5.8.7) ~ stable
    Manjaro (ext4, Xfce) ~ rolling updates
    Tumbleweed (ext4, KDE Plasma5) ~ managed updates via "Tumbleweed Snapshots" service.

  5. #5

    Default Re: Methods or applications for data recovering

    Quote Originally Posted by john_hudson View Post
    Many problems can be dealt with by programs like the openSUSE recovery mode or the SuperGrub Disk but, for the Swiss Army knife of recovery tools, you can download http://www.sysresccd.org/SystemRescueCd_Homepage.

    BTW this program will also recover Windows data and it is free.
    I was actually thinking about recovering lost files by accidental/intentional erasing or formatting, either on Windows and Linux. But now that you mention partition or sector repair, that would be also important...

    So would you consider SystemRescueCd would be one of the best Linux tools, comparable with several other professional proprietary software?
    Could testdisk be HDD Regenerator's analog?
    And now that I read about it, there was a tool named Trinity Rescue Kit that I used to use for Windows password blanking, but it says it also supports some file/partition recovery. What would you say about this one?

    @robin_listas:
    That's why I said "the author sounded". His line "there is still hope but I won’t tell how to bring it back" kind of sounded for me like a bit coldhearted. This was the "spoiler" I mentioned, because he briefly tells about something that he won't focus on at all. Though it just could be that the article's topic wasn't that one, but those were my impressions.

  6. #6
    Join Date
    Jun 2008
    Location
    UK
    Posts
    5,500

    Default Re: Methods or applications for data recovering

    Quote Originally Posted by F_style View Post
    I was actually thinking about recovering lost files by accidental/intentional erasing or formatting, either on Windows and Linux.
    Also known as "undeleting" files.
    Leap 42.3 (ext4, KDE Plasma 5.8.7) ~ stable
    Manjaro (ext4, Xfce) ~ rolling updates
    Tumbleweed (ext4, KDE Plasma5) ~ managed updates via "Tumbleweed Snapshots" service.

  7. #7
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Methods or applications for data recovering

    On 2014-02-22 04:56, F style wrote:
    > @robin_listas:
    > That's why I said "the author sounded". His line "there is still hope
    > but I won’t tell how to bring it back" kind of sounded for me like a
    > bit coldhearted. This was the "spoiler" I mentioned, because he briefly
    > tells about something that he won't focus on at all. Though it just
    > could be that the article's topic wasn't that one, but those were my
    > impressions.


    The paragraph is more or less absurd. He says:

    > Removing with GUIs delete most times just sends files to Trash bin where they can be read normally.


    True. They don't delete, they move. Windows does the same.

    > Same goes with deleting them permanently. It just tells to filesystem this part of hard disk is up for usage again.


    Yes, but you can not read them "normally". You need an undeletion or
    file carve tool, and you need to use it real fast. I gave some samples
    of such tools.

    > It takes many writes in that part of hard disk before it’s safe to say you can’t recover any of old data.


    After even a single pass, no known tool that runs on your computer will
    recover anything. The NSA or the CIA or such, might, but there is
    nothing definite about what they really can do. Obviously :-)

    > So if you just accidentally deleted file and popped up here there is still hope but I won’t tell how to bring it back.


    Absurd and unintelligible sentence, IMO.

    Why will he not tell how to recover accidentally deleted files? That's
    what everybody wants to do and many people know how to do or how to find
    out about it.

    Unless he is thinking that you want to recover files from somebody
    else's hard disk, which is of course unethical.

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  8. #8

    Default Re: Methods or applications for data recovering

    Quote Originally Posted by F_style View Post
    So would you consider SystemRescueCd would be one of the best Linux tools, comparable with several other professional proprietary software?
    Could testdisk be HDD Regenerator's analog?
    And now that I read about it, there was a tool named Trinity Rescue Kit that I used to use for Windows password blanking, but it says it also supports some file/partition recovery. What would you say about this one?
    So actually none of these would be good for what I was thinking originally (undeleting)? I already knew it's best -and a must- to not write anything on the disk if one wants to recover files.

  9. #9
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    25,547

    Default Re: Methods or applications for data recovering

    On 2014-02-22 17:06, F style wrote:
    > So actually none of these would be good for what I was thinking
    > originally (undeleting)? I already knew it's best -and a must- to not
    > write anything on the disk if one wants to recover files.


    Right. Undeleting only can be attempted if the sectors used by the
    deleted files have not been yet overwritten.

    --
    Cheers / Saludos,

    Carlos E. R.

    (from 13.1 x86_64 "Bottle" (Minas Tirith))

  10. #10
    Join Date
    Jun 2008
    Location
    UK
    Posts
    5,500

    Default Re: Methods or applications for data recovering

    Quote Originally Posted by robin_listas View Post
    On 2014-02-22 17:06, F style wrote:
    > So actually none of these would be good for what I was thinking
    > originally (undeleting)? I already knew it's best -and a must- to not
    > write anything on the disk if one wants to recover files.


    Right. Undeleting only can be attempted if the sectors used by the
    deleted files have not been yet overwritten.
    Unfortunately, yes, as I found out the hard way one day, and nowadays it gets overwritten very quickly.

    BTW I thought is was well known that many Windows users keep a SystemRescueCD handy, because Linux recovery tools are just better. When I bought my replacement internal HDD from the very local shop, they told me two things after 15+ years experience: WD HDD's were the most reliable, and Linux tools were superior.
    Leap 42.3 (ext4, KDE Plasma 5.8.7) ~ stable
    Manjaro (ext4, Xfce) ~ rolling updates
    Tumbleweed (ext4, KDE Plasma5) ~ managed updates via "Tumbleweed Snapshots" service.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •