If you're a fan of Linux systems and have a hard drive crashing, see in this article the best 5 systems we think can recover your valuable data.
Logically, there is no computer user who, in his total preoccupation with computers, has not found himself in the awkward position of not being able to read a data storage unit, due to damaged or "hit" material. Knowing that if you find yourself in such a situation then the panic of data loss, probably makes you not think clearly and desperately looking for an immediate solution, here are 5 data recovery systems for Linux systems. Respectively for Windows systems we have already written several articles that you can find with a simple search on our website. So let's get started.
1. Ddrescue
While the Ddrescue is not purely a data recovery tool, it should stand as your first step in trip you, in recovering your files. ddrescue creates an image of your problematic drive or partition so you can analyze one copy of your broken disc and not the disc itself.
Always copy your disc to a separate image before you start file recovery operations with the following tools. The more you use the actual damaged unit, the more damage you can cause it.
What you see in the image above is some ddrescue work. In the first command, it copies the entire disk to an image called "backup.img". The second command then copies only the damaged blocks in the same image, passing over these blocks three times each to try to read them more correctly.
When you run the same commands, always use a logfile. Backups can take hours or days to complete without a log, any interruptions will make you start the process again from scratch.
When this process is complete for disk or the apartment you can mount the copied image and use the following utilities to recover files from it. Further use of the following recovery tools for Linux will pull data from the “backup.img” created here itself.
2. Foremost
The Foremost uses the structure of common file types to retrieve data. You can either retrieve the entire disk image with all its files, or specify some types of files that are most interesting to you.
What you can see in the above photo is Foremost's results in verbose mode (or -v option). The -t option searches for .jpg file types and the -i and -o options respectively indicate the input file and the output directory.
You can see Foremost analyzes the image created with Ddrescue in the previous step. This image (backup.img) has some JPEG files inside it. Foremost was able to find ten such files and, after pulling them from the image, copied them in the output file.
3. Scalpel
The Scalpel, which in Greek means scalpel, is based on Foremost, but aiming to be more modest in its operation. Effectively uses a multi-threading method and an asynchronous input / output to search within images. In addition, it gives them users the ability to specify the number of footers and heaters they wish to use for file retrieval.
Users can also specify the file types they want to retrieve by changing the Scalpel configuration command. By default, it searches for all files, even without the verbose function being enabled (-v parameter).
In this photo you can see the results of the Scalpel analysis on the “backup.img” image. The main command (listed at the bottom of the screenh) requires only an output folder and an image to analyze.
4. PhotoRec
The PhotoRec differentiates itself from its competitors, focusing on retrieving photos, videos and text documents. It also works as an interactive utility through its graphical environment.
The original PhotoRec command prompts you to specify the desired image (backup.img file) and the output folder. PhotoRec then displays a graphical interface where it shows the size of the image. On subsequent screens it asks for the type of partition on the disc and if you want to search the entire image.
5. Grep
And finally, we arrived at Grep. Perhaps this program may not seem like the simplest data retrieval application, but Grep has the power to find deleted or lost text files by searching for strings existing on a block or on a disk image.
There is a file in backup.img called "myfile". Contains only one line of text, "This is the file I will try to recover". Grep uses this string as a starting point for retrieving files. In addition to some other parameters, you can see in this example that it stores the detected string in a new binary named "foundtext".
In particular, you should pay attention (and modify) the -C parameter that affects the frame surrounding the string you are looking for. This command, for example, tells Grep to find a line of text before and after the string we're looking for.
If you say -CNUMX, grep will find 200 lines both before and after, from this string. This feature may not seem necessary to you, but it could be important for larger text files with hundreds of lines. Of course, you should remember the text of your own files so that grep has a starting point to begin its search.
Grep will create a binary file as a result. Some parts of it will be readable, such as the desired text line of this example near the bottom of the photo below.
Beyond that, it's your job to manually search for the data you need. It's definitely hard work, but it's an alternative to not recovering a file.
In conclusion
In a nutshell, be sure to first copy your drive or partition with Ddrescue, then work on this copy with any of the next Linux recovery tools. Do not be afraid to try more than one tool, especially if you did not find the data you want at the first option.
Data recovery requires patience and enough luck. But he compensates and before you know it you will have your valuable files back.
