File recovery

From ArchWiki
Revision as of 22:52, 19 August 2009 by Graysky (Talk | contribs)

Jump to: navigation, search


Preface/Introduction

Page Overview

This article is meant to capture several file recovery or undelete options for Arch/Linux. Please contribute to this page using the general format below and keeping it brief.

Special Notes

Backup Flash Media/Small Partitions

As an alternative to working with a 'live' partition (mounted or not), it is often preferable to work with an image provided that the filesystem in question isn't too large and that you have sufficient free HDD space to accommodate the image file. For example, flash memory devices like, thumb drives, digital cameras, portable music players, cellular phones, etc.

Be sure to read the man pages for the utilities listed below to verify that they are capable of working with an image file.

To make an image, one can use dd as follows:

# dd if=/dev/target_partition of=/home/user/partition.image

Working with Digital Cameras

In order for some of the utils listed in the next section to work with flash media, one needs to have the device in question mounted as a block device (i.e. it is listed under /dev). Digital cameras operating in PTP (Picture Transfer Protocol) mode will not work in this regard. PTP cameras are transparently handled by libgphoto and/or libptp. Transparently as in, they don't get a block device. The alternative to PTP mode is USB Mass Storage (UMS) mode which may or may not be supported by your camera. Some cameras will have a menu item allowing the user to switch between the two modes; refer to your camera's user manual. If your camera does not support UMS mode and therefore cannot be accessed as a block device, your only alternative is to use a flash media reader and physically remove the media from your camera.

Foremost

Description

Foremost is a console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers can be specified by a configuration file or you can use command line switches to specify built-in file types. These built-in types look at the data structures of a given file format allowing for a more reliable and faster recovery.

Installation

Foremost is available from the [AUR] in [this page].

External Links

Photorec

Description

Photorec is a complementary utility to TestDisk; both open-source data recovery utilities licensed under the terms of the [GNU Public License] (GPL). Photorec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its 'Photo Recovery' name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media's filesystem has been severely damaged or re-formatted.

Installation

Both TestDisk and Photorec are available for Arch i686 and x64_86 in the same package.

# pacman -S testdisk

External Links

Testdisk

Description

TestDisk, like Photorec are both open-source data recovery utilities licensed under the terms of the [GNU Public License] (GPL). TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table).

Installation

Both TestDisk and Photorec are available for Arch i686 and x64_86 in the same package.

# pacman -S testdisk

External Links