Methods or applications for data recovering

English Applications
1

I came from reading this article, and though the topic is the exact opposite, I think the spoiler the author gave at the very end of second paragraph slightly affected me… I don’t know if the author is open for contact should I try to ask him…

Point is, are there good tools/applications for data recovery on Linux?

The author sounded as if telling that kind of information was forbidden, or the like. I know there are of course programs for Windows or even bootable to do recovery stuff, though most of them are proprietary; and probably Linux tools are efficient enough for the author to consider not wise enough to openly talk about them, or that’s what I imagined…

Thanks beforehand.

2

A lot of the problems are dealt with inherently; for example, if someone pulls the plug on your laptop, as someone accidentally did to me recently, you simply reboot and ext4 will recover everything.

Many problems can be dealt with by programs like the openSUSE recovery mode or the SuperGrub Disk but, for the Swiss Army knife of recovery tools, you can download http://www.sysresccd.org/SystemRescueCd_Homepage.

BTW this program will also recover Windows data and it is free.

3

On 2014-02-21 20:46, F style wrote:
>
> I came from reading ‘this article’ (http://tinyurl.com/k3vybcu), and
> though the topic is the exact opposite, I think the spoiler the author
> gave at the very end of second paragraph slightly affected me… I don’t
> know if the author is open for contact should I try to ask him…

Sorry, I don’t quite understand. language barrier, perhaps. What
spoiler, exactly?

> Point is, are there good tools/applications for data recovery on Linux?
>
> The author sounded as if telling that kind of information was forbidden,
> or the like. I know there are of course programs for Windows or even
> bootable to do recovery stuff, though most of them are proprietary; and
> probably Linux tools are efficient enough for the author to consider not
> wise enough to openly talk about them, or that’s what I imagined…

I don’t understand any of that. Why would data recover tools be forbidden?

There are tools in Linux to try recover files after accidental
destruction, as long as the data is actually there, but not the metadata
that allows the operating system to locate files, where a particular
file is stored. The idea is to search the entire disk for recognizable
file headers, and then try to recover the rest of each file, one by one.
Photorec does quite a good job of recovering jpeg files (and some video
files) out of a camera flash disk, for instance. Or any hard disk, for
that matter. But it works badly at recovering about any other type of file.

This method is called “data or file carving”.

Another good file carver is “foremost”.

On the same suite than photorec is testdisk, that does a reasonable good
job of repairing partition damage. It would be the first thing to try.

ext4magic can try recover some deleted files in ext4 partition.

There are, of course, proprietary software for this, and some are pretty
good. How they do it they keep secret, but not because illegal, but to
avoid competitors so that they keep making money. I have used “Restorer
Ultimate” with good results.

However, if the disk was intentionally deleted, via overwriting all
sectors with something else, none of those tools will recover any data
at all. To try recover what was there you need a good forensic lab,
money, time, and resources. What are the possibilities, nobody really
knows, and those that really know do not talk. We guess that people on
the NSA or the CIA can do it :-p

(the basic idea is to read the remaining, overlapping, microscopic, and
weak magnetic fields in the disk plates, somehow).

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

4

Yes, it is excellent with good documentation provided. I used it to rescue the partitions of a failing internal HDD, and recover them to a new one. That included a couple of Win 7 partitions, data and several openSUSE partitions. As well as the usual tools, particularly useful were “testdisk” to aid rescue, and “partclone” for backup/restore of used blocks (similar to “partimage” but supports ext4).

5

I was actually thinking about recovering lost files by accidental/intentional erasing or formatting, either on Windows and Linux. But now that you mention partition or sector repair, that would be also important…

So would you consider SystemRescueCd would be one of the best Linux tools, comparable with several other professional proprietary software?
Could testdisk be HDD Regenerator’s analog?
And now that I read about it, there was a tool named Trinity Rescue Kit that I used to use for Windows password blanking, but it says it also supports some file/partition recovery. What would you say about this one?

@robin_listas:
That’s why I said “the author sounded”. His line “there is still hope but I won’t tell how to bring it back” kind of sounded for me like a bit coldhearted. This was the “spoiler” I mentioned, because he briefly tells about something that he won’t focus on at all. Though it just could be that the article’s topic wasn’t that one, but those were my impressions.

6

Also known as “undeleting” files.

7

On 2014-02-22 04:56, F style wrote:
> @robin_listas:
> That’s why I said “the author sounded”. His line “there is still hope
> but I won’t tell how to bring it back” kind of sounded for me like a
> bit coldhearted. This was the “spoiler” I mentioned, because he briefly
> tells about something that he won’t focus on at all. Though it just
> could be that the article’s topic wasn’t that one, but those were my
> impressions.

The paragraph is more or less absurd. He says:

> Removing with GUIs delete most times just sends files to Trash bin where they can be read normally.

True. They don’t delete, they move. Windows does the same.

> Same goes with deleting them permanently. It just tells to filesystem this part of hard disk is up for usage again.

Yes, but you can not read them “normally”. You need an undeletion or
file carve tool, and you need to use it real fast. I gave some samples
of such tools.

> It takes many writes in that part of hard disk before it’s safe to say you can’t recover any of old data.

After even a single pass, no known tool that runs on your computer will
recover anything. The NSA or the CIA or such, might, but there is
nothing definite about what they really can do. Obviously :slight_smile:

> So if you just accidentally deleted file and popped up here there is still hope but I won’t tell how to bring it back.

Absurd and unintelligible sentence, IMO.

Why will he not tell how to recover accidentally deleted files? That’s
what everybody wants to do and many people know how to do or how to find
out about it.

Unless he is thinking that you want to recover files from somebody
else’s hard disk, which is of course unethical.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

8

So actually none of these would be good for what I was thinking originally (undeleting)? I already knew it’s best -and a must- to not write anything on the disk if one wants to recover files.

9

On 2014-02-22 17:06, F style wrote:
> So actually none of these would be good for what I was thinking
> originally (undeleting)? I already knew it’s best -and a must- to not
> write anything on the disk if one wants to recover files.

Right. Undeleting only can be attempted if the sectors used by the
deleted files have not been yet overwritten.

–
Cheers / Saludos,

Carlos E. R.

(from 13.1 x86_64 “Bottle” (Minas Tirith))

10

Unfortunately, yes, as I found out the hard way one day, and nowadays it gets overwritten very quickly.

BTW I thought is was well known that many Windows users keep a SystemRescueCD handy, because Linux recovery tools are just better. When I bought my replacement internal HDD from the very local shop, they told me two things after 15+ years experience: WD HDD’s were the most reliable, and Linux tools were superior. :slight_smile:

11

There is a kind of professional tool can help to freerecover lost data from Linux. This tool is very easy-to-use and flexible. So if there is a need, just have a try. Visit this website and get more detailed information, I’m sure this tool can help you out of the trouble.