5 Linux tools for recovering data from corrupted drives

If you're a fan of Linux systems and have a hard drive crashing, see in this article the best 5 systems we think can recover your valuable data.

Logically, there is no computer user who, in his total preoccupation with computers, has not found himself in the awkward position of not being able to read a data storage unit, due to damaged or "hit" material. Knowing that if you find yourself in such a situation then the panic of data loss, probably makes you not think clearly and desperately looking for an immediate solution, here are 5 data recovery systems for Linux systems. Respectively for Windows systems we have already written several articles that you can find with a simple search on our website. So let's get started.

1. Ddrescue
While the Ddrescue is not a pure data recovery tool, it should stand as your first step on your journey, recovering your files. Ddrescue creates an image of your troublesome unit or partition so you can analyze a copy of your broken disk rather than the disk itself.

Always copy your disc to a separate image before you start file recovery operations with the following tools. The more you use the actual damaged unit, the more damage you can cause it.ddrescue


What you see in the image above is some ddrescue work. In the first command, it copies the entire disk to an image called "backup.img". The second command then copies only the damaged blocks in the same image, passing over these blocks three times each to try to read them more correctly.

When you run the same commands, always use a logfile. Backups can take hours or days to complete without a log, any interruptions will make you start the process again from scratch.

When this process is complete for your disk or partition, you can attach the copied image and use the following utilities to recover files from it. Further use of the following recovery tools for Linux will retrieve data from the "backup.img" created here.

2. Foremost
The Foremost uses the structure of common file types to retrieve data. You can either retrieve the entire disk image with all its files, or specify some types of files that are most interesting to you.


What you can see in the above photo is Foremost's results in verbose mode (or -v option). The -t option searches for .jpg file types and the -i and -o options respectively indicate the input file and the output directory.

You can see Foremost analyzes the image created with Ddrescue in the previous step. This image (backup.img) has some JPEG files inside it. Foremost was able to find ten such files and, after pulling them from the image, copied them in the output file.

3. Scalpel
The Scalpel, which in Greek means a lancet, is based on Foremost, but aims to be more fluid in its operation. It effectively uses a multi-threading method and an asynchronous input / output to search within the images. In addition, it gives users the ability to determine the number of footers and heaters they want to use to retrieve files.

Users can also specify the file types they want to retrieve by changing the Scalpel configuration command. By default, it searches for all files, even without the verbose function being enabled (-v parameter).

linux scalpel screenshot clipped png webp

In this photo you can see the results of Scalpel analysis in the image "backup.img". The basic command (listed at the bottom of the screen) requires only one output folder and one image for resolution.

4. PhotoRec
The PhotoRec differentiates itself from its competitors, focusing on retrieving photos, videos and text documents. It also works as an interactive utility through its graphical environment.
linux photorec

The original PhotoRec command prompts you to specify the desired image (backup.img file) and the output folder. PhotoRec then displays a graphical interface where it shows the size of the image. On subsequent screens it asks for the type of partition on the disc and if you want to search the entire image.

5. Grep
And finally, we arrived at Grep. Perhaps this program may not seem like the simplest data retrieval application, but Grep has the power to find deleted or lost text files by searching for strings existing on a block or on a disk image.

Linux GREP

There is a file in backup.img called "myfile". Contains only one line of text, "This is the file I will try to recover". Grep uses this string as a starting point for retrieving files. In addition to some other parameters, you can see in this example that it stores the detected string in a new binary named "foundtext".

In particular, you should pay attention (and modify) the -C parameter that affects the frame surrounding the string you are looking for. This command, for example, tells Grep to find a line of text before and after the string we're looking for.

If you say -CNUMX, grep will find 200 lines both before and after, from this string. This feature may not seem necessary to you, but it could be important for larger text files with hundreds of lines. Of course, you should remember the text of your own files so that grep has a starting point to begin its search.

Grep will create a binary file as a result. Some parts of it will be readable, such as the desired text line of this example near the bottom of the photo below.

linux grep h

Beyond that, it's your job to manually search for the data you need. It's definitely hard work, but it's an alternative to not recovering a file.

In conclusion

In a nutshell, be sure to first copy your drive or partition with Ddrescue, then work on this copy with any of the next Linux recovery tools. Do not be afraid to try more than one tool, especially if you did not find the data you want at the first option.

Data recovery requires patience and enough luck. But he compensates and before you know it you will have your valuable files back.

iGuRu.gr The Best Technology Site in Greece
Follow us on Google News

Written by Dimitris

Dimitris hates on Mondays .....

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).