Thursday, October 29, 2009

recover files deleted from linux in 5 steps

I usually like to stay short when writing about things so here is my quick and dirt recovery directions:

1. disable automount : gconftool-2 --type bool --set /apps/nautilus/preferences/media_automount false
2. install libntfs10 testdisk
3. install dd_rescue (optional)
4. dd_rescue the partition you want to recover so to have a backup (optional)
(deleted partitions)5. testdisk http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_FAT
(photos and other files)5. install photorec and use it, it's intended for photos but is ok also for other files.

anyway if you like long story you can follow the directions of the nice Damien's blog which I partially copy here for reference

http://www.makeuseof.com/tag/recover-deleted-files-from-your-linux-system/

TestDisk – Recover Lost Partitions

TestDisk is a partition recovery software that can recover any lost partition or make a non-booting disk bootable again. It can be really handy when your hard disk has crashed due to faulty software, viruses or any accidental removal of the partition.

It doesn't matter whether you are using Windows, Linux, Mac or any other UNIX system because TestDisk is able to recover them all.

recover partition

As you can see from the image above, TestDisk is run in the terminal (or DOS) mode. That doesn't mean it is difficult to use. There is no command line to remember. All you need to do is to move your arrow keys and press Enter to select the right answer, just like how you answer an online survey.

Select the hard disk to scan for the lost partition :

recover lost files

Select the partition type :

testdisk-screenshot3

Find the lost partition :

testdisk-screenshot4

Write the data to the partition :

testdisk-screenshot5

Most of the time when your hard disk has crashed, or fails to boot, it doesn't mean that it is spoilt. It could just be due to a corrupted file or accidental removal of the boot record, which can be easily fixed with TestDisk.

I have successfully restored two 80GB hard disks that originally could not be booted up.

PhotoRec – Recover Lost and Deleted Files

PhotoRec works to recover lost files from any storage devices, including video, documents, pictures and archives from hard disks, memory cards, USB thumb drives and CD-ROM's. It doesn't care what filesystem you are using and it goes deep under to dig out any underlying data.

Even if your storage device is severely damaged or re-formatted, there is a great chance that you can retrieve your data, as long as it has not been overwritten.

photorec-recover deleted files

Unlike other data recovery software, PhotoRec does not come with a nice user interface and it does not allows you to select which files to restore. By default, it will recover all the files that it can find, but you can configure it to search only for a particular file extension.

photorec-screenshot2

A point to note while using PhotoRec: you should never restore a file to its original location as it will overwrite the data and make the file unrecoverable. Instead, restore the files to a secondary hard disk or a separate partition.

No comments:

Post a Comment