Difference between revisions of "File recovery"

From ArchWiki
Jump to: navigation, search
(Section about failing disks, link to disk cloning article)
Line 6: Line 6:
 
This article is meant to capture several file recovery or undelete options for Arch/Linux.  Please contribute to this page using the general format below and keeping it brief.
 
This article is meant to capture several file recovery or undelete options for Arch/Linux.  Please contribute to this page using the general format below and keeping it brief.
 
===Special Notes===
 
===Special Notes===
 +
====Failing Drives====
 +
In the arena of data recovery, it is best to work on images of disks rather than the physical disks themselves. Generally, a failing drive's condition worsens over time. The goal ought to be to copy as much data as possible as early as possible, and to then abandon the disk. The dd_rescue utility (ddrescue in repos), unlike dd will repeatedly try to recover from errors, and will read the drive front to back, then back to front, attempting to salvage data. It keeps a log file so that you can pause and resume recovery without losing your progress.
 +
 +
See [[disk cloning]].
 +
 +
The image files created from a utility like ddrescue can then be mounted like a physical device and can be worked on safely. Always make a copy of the original image so that you can revert if things go sour!
 +
 +
A tried and true method of improving failing drive reads is to keep it cold. A bit of time in the freezer is appropriate, but be careful to avoid bringing the drive from cold to warm too quickly, as condensation will form. Keeping the drive in the freezer with cables connected to the recovering PC works great.
 +
 +
Do not attempt a filesystem check on a failing drive, as this will likely make the problem '''worse'''. Keep it read-only.
 
====Backup Flash Media/Small Partitions====
 
====Backup Flash Media/Small Partitions====
 
As an alternative to working with a 'live' partition (mounted or not), it is often preferable to work with an image provided that the filesystem in question isn't too large and that you have sufficient free HDD space to accommodate the image file. For example, flash memory devices like, thumb drives, digital cameras, portable music players, cellular phones, etc.  
 
As an alternative to working with a 'live' partition (mounted or not), it is often preferable to work with an image provided that the filesystem in question isn't too large and that you have sufficient free HDD space to accommodate the image file. For example, flash memory devices like, thumb drives, digital cameras, portable music players, cellular phones, etc.  

Revision as of 03:53, 23 September 2009


Preface/Introduction

Page Overview

This article is meant to capture several file recovery or undelete options for Arch/Linux. Please contribute to this page using the general format below and keeping it brief.

Special Notes

Failing Drives

In the arena of data recovery, it is best to work on images of disks rather than the physical disks themselves. Generally, a failing drive's condition worsens over time. The goal ought to be to copy as much data as possible as early as possible, and to then abandon the disk. The dd_rescue utility (ddrescue in repos), unlike dd will repeatedly try to recover from errors, and will read the drive front to back, then back to front, attempting to salvage data. It keeps a log file so that you can pause and resume recovery without losing your progress.

See disk cloning.

The image files created from a utility like ddrescue can then be mounted like a physical device and can be worked on safely. Always make a copy of the original image so that you can revert if things go sour!

A tried and true method of improving failing drive reads is to keep it cold. A bit of time in the freezer is appropriate, but be careful to avoid bringing the drive from cold to warm too quickly, as condensation will form. Keeping the drive in the freezer with cables connected to the recovering PC works great.

Do not attempt a filesystem check on a failing drive, as this will likely make the problem worse. Keep it read-only.

Backup Flash Media/Small Partitions

As an alternative to working with a 'live' partition (mounted or not), it is often preferable to work with an image provided that the filesystem in question isn't too large and that you have sufficient free HDD space to accommodate the image file. For example, flash memory devices like, thumb drives, digital cameras, portable music players, cellular phones, etc.

Be sure to read the man pages for the utilities listed below to verify that they are capable of working with an image file.

To make an image, one can use dd as follows:

# dd if=/dev/target_partition of=/home/user/partition.image

Working with Digital Cameras

In order for some of the utils listed in the next section to work with flash media, one needs to have the device in question mounted as a block device (i.e. it is listed under /dev). Digital cameras operating in PTP (Picture Transfer Protocol) mode will not work in this regard. PTP cameras are transparently handled by libgphoto and/or libptp. Transparently as in, they don't get a block device. The alternative to PTP mode is USB Mass Storage (UMS) mode which may or may not be supported by your camera. Some cameras will have a menu item allowing the user to switch between the two modes; refer to your camera's user manual. If your camera does not support UMS mode and therefore cannot be accessed as a block device, your only alternative is to use a flash media reader and physically remove the media from your camera.

Foremost

Description

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Installation

Foremost is available from the [AUR] in [this page].

External Links

Photorec

Description

Photorec is a complementary utility to TestDisk; both open-source data recovery utilities licensed under the terms of the [GNU Public License] (GPL). Photorec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its 'Photo Recovery' name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media's filesystem has been severely damaged or re-formatted.

Installation

Both TestDisk and Photorec are available for Arch i686 and x64_86 in the same package.

# pacman -S testdisk

External Links

Testdisk

Description

TestDisk, like Photorec are both open-source data recovery utilities licensed under the terms of the [GNU Public License] (GPL). TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table).

Installation

Both TestDisk and Photorec are available for Arch i686 and x64_86 in the same package.

# pacman -S testdisk

External Links