On 2014-02-21 20:46, F style wrote:
> I came from reading ‘this article’ (http://tinyurl.com/k3vybcu), and
> though the topic is the exact opposite, I think the spoiler the author
> gave at the very end of second paragraph slightly affected me… I don’t
> know if the author is open for contact should I try to ask him…
Sorry, I don’t quite understand. language barrier, perhaps. What
> Point is, are there good tools/applications for data recovery on Linux?
> The author sounded as if telling that kind of information was forbidden,
> or the like. I know there are of course programs for Windows or even
> bootable to do recovery stuff, though most of them are proprietary; and
> probably Linux tools are efficient enough for the author to consider not
> wise enough to openly talk about them, or that’s what I imagined…
I don’t understand any of that. Why would data recover tools be forbidden?
There are tools in Linux to try recover files after accidental
destruction, as long as the data is actually there, but not the metadata
that allows the operating system to locate files, where a particular
file is stored. The idea is to search the entire disk for recognizable
file headers, and then try to recover the rest of each file, one by one.
Photorec does quite a good job of recovering jpeg files (and some video
files) out of a camera flash disk, for instance. Or any hard disk, for
that matter. But it works badly at recovering about any other type of file.
This method is called “data or file carving”.
Another good file carver is “foremost”.
On the same suite than photorec is testdisk, that does a reasonable good
job of repairing partition damage. It would be the first thing to try.
ext4magic can try recover some deleted files in ext4 partition.
There are, of course, proprietary software for this, and some are pretty
good. How they do it they keep secret, but not because illegal, but to
avoid competitors so that they keep making money. I have used “Restorer
Ultimate” with good results.
However, if the disk was intentionally deleted, via overwriting all
sectors with something else, none of those tools will recover any data
at all. To try recover what was there you need a good forensic lab,
money, time, and resources. What are the possibilities, nobody really
knows, and those that really know do not talk. We guess that people on
the NSA or the CIA can do it :-p
(the basic idea is to read the remaining, overlapping, microscopic, and
weak magnetic fields in the disk plates, somehow).
Cheers / Saludos,
Carlos E. R.
(from 13.1 x86_64 “Bottle” (Minas Tirith))