- Install Testdisk
- Install Testdisk On Linux
- Install Testdisk Ubuntu
- Install Testdisk Ubuntu 18.04
- Install Test Disk In Linux Mint
Type `make install' to install the programs and any data files and documentation. When installing into a prefix owned by root, it is recommended that the package be configured and built as a regular user, and only the `make install' phase executed with root privileges. Download and Install TestDisk. You can find lots of free partition recovery tools using Google, but we think TestDisk is the best tool for the job (though we’ve touched on a couple of alternatives later in the article).
Did your screen just turn black or your laptop freeze without warning? Maybe your hard drive has started chirping. Worse yet, maybe you suddenly can’t save to your home partition.
All these signs of a corrupted or failing drive can cause you to sweat, but there’s no reason to immediately throw away your computer. Keep reading to learn about six Linux tools that can help you retrieve your data and get your digital life back on track.
Related: How to Recover Data and Partitions for Free with TestDisk
1. Trinity Rescue Kit
This live Linux distro made specifically for data recovery seemed to have been left for dead years ago, but a couple of years ago its developer turned up with an update out of nowhere that makes it run more effectively on modern computers.
So what is Trinity Rescue Kit? Essentially, if your main Linux OS (or Windows or macOS for that matter) becomes unusable due to hard drive failure or some other catastrophe, you can create a TRK USB drive, then boot to it to pull data from your main OS using a command line. It’s a rescue disk, and a really rather good one that has extra features like password recovery and virus scanning.
![Install Install](/uploads/1/2/6/1/126177919/390259462.png)
There is, of course, a bulk-undelete utility here too that scours your damaged or inaccessible hard drives for anything that can be recovered, and a couple of options for master boot record repair too. Be warned though, that there’s quite a steep learning curve to really take advantage of all these features.
2. Testdisk
Certain Linux recovery tools attempt to save your data by copying whatever is retrievable from a damaged partition. This can work, but isn’t guaranteed as issues with the partition itself may be obscuring the data you want to retrieve.
Testdisk comes in handy as it can actually fix partition-level errors, making it easier to recover data using Testdisk itself or another data recovery tool. It may even outright fix a corrupted hard drive and make your Linux PC work again, so you can access the data directly.
- TestDisk Partition Recovery Software. The best method to use TestDisk is to boot from a DVD and then use a thumb/flash drive to run the TestDisk utility. That way, you can check all the partitions.
- Data Recovery With TestDisk TestDisk is a powerful free data recovery software which was primarily designed to help recover lost partitions and/.
- Install the testdisk package, which provides both TestDisk and PhotoRec. Usage After running e.g. Ddrescue to create image.img, photorec image.img will open a terminal UI where you can select what file types to search for and where to put the recovered files.
As well as carrying out deep-diving operations like restoring boot sectors and filesystem tables, Testdisk is also capable of recovering data – even deleted data – from hard drives in the NTFS, FAT, exFAT and ext formats.
https://quadgenerous.weebly.com/indesign-cc-crack-mac.html. To install Testdisk on Linux, go to the Terminal and enter
If you want to know more about using Testdisk, you can read our Testdisk guide here.
3. ddrescue
While ddrescue isn’t a data recovery tool in title, it should stand as your first step in the journey to retrieving your files. Ddrescue creates an image of your corrupt drive or partition so you can analyze a copy of your broken disk.
Always copy your disk to a separate image before you begin file recovery operations with the tools listed below. The more you use your actual failing drive, the more damage you can cause it.
What you see here is some output of ddrescue in action. In the first command, it copies the entire disk to an image named “backup.img.” The second command then copies only the bad blocks to that same image, passing over those blocks three times each to try to read them.
When you run these same commands, always use a logfile. Backups can take hours or days to complete, and without a logfile, any interruptions will make you start the process again from the beginning.
When this process is complete for your own disk or partition, you can mount the copied image and use the following utilities to retrieve files from it. Further use of our other Linux recovery tools in this article will grab data from the same “backup.img” created here.
4. Foremost
Foremost uses the data structures of common file types to retrieve data. You can either scrape an entire disk image for all its files or specify certain file types you’re most interested in.
What you can see here is the output of Foremost in verbose mode (the
-v
option). The -t
option searches for file types of jpg, and the -i
and -o
options mark the respective input file and output directory.You can see that Foremost analyzes the image ddrescue created in the previous step; that image has a number of JPEGs in it. Foremost was able to find ten such files, and when it was done scraping the image, it copied those ten files to the stated output folder.
5. scalpel
Scalpel, originally based on Foremost, aims to be frugal in its operation. It uses multi-threading and asynchronous input/output to search through images in an efficient manner. Moreover, it gives users the power to specify the number of footers and headers they wish to use for file recovery.
Users can also specify the types of files they want to recover by editing scalpel’s configuration file. The default configuration produces a lot of output, even without verbose mode (-v parameter) turned on.
In that screenshot you can see the final output of scalpel’s analysis of “backup.img.” The basic command (listed at the bottom of the screenshot) requires only an output directory and an image for analysis.
6. PhotoRec
PhotoRec strays away from its competitors by focusing on the recovery of photographs, videos, and text documents. It also works as an interactive utility within the console itself. Check out all its majesty
The initial PhotoRec command must specify a desired image (our backup.img) and output folder. PhotoRec then drops the user into its graphical environment. New blue fx serial number. The screenshot here shows the image size. In further screens it asks for the disk’s partition type and whether or not you want to search the entire image for files.
7. grep
Finally, we come to grep. This may also not seem like the most straightforward of recovery options, but grep has the power to find deleted or lost text files by searching for strings present on a block device or disk image.
A file exists in backup.img called “myfile.” It contains only one line of text: “This is the file I will try to recover.”
Grep uses that string as its starting point for file recovery. Alongside a few other parameters, you can see that, in this example, it dumps the found string into a new binary file named “foundtext.”
In particular, you will want to pay attention to – and modify – the
-C
parameter which prints extra context surrounding the string in the initial command. This example command tells grep to find one line of text before and one after the provided string.Starting at
-C 200
, grep would find 200 lines both before and after a string. Such reach is unnecessary here, but it could be important for larger text files with hundreds of lines. You will, of course, need to know the text of your own files so grep has a starting point to begin its search.Grep will generate a binary file as its output. Still, some parts will be human-readable, such as this example’s desired line of text near the bottom of this screenshot. It will be your job to manually scrape out the data you need. It’s tough work, for sure, but it beats the alternative of having no file at all.
Conclusion
In summary, be sure to first copy your drive or partition with ddrescue, then work on that copy with any of the other Linux recovery tools you need. Don’t be afraid to try more than one tool, especially if your first choice didn’t find the data you wanted.
Be patient. With any luck, you’ll have your precious files back before you know it.
This article was first published in Feb 2018 and was updated in March 2019.
Ebooks
(Redirected from File Recovery)
This article lists data recovery and undeletion options for Linux.
- 1Special notes
- 3Extundelete
- 5Testdisk and PhotoRec
- 6e2fsck
- 7Working with raw disk images
- 7.2Mounting partitions
Special notes
Before you start
This page is mostly intended to be used for educational purposes. If you have accidentally deleted or otherwise damaged your valuable and irreplaceable data and have no previous experience with data recovery, turn off your computer immediately (Just press and hold the off button or pull the plug; do not use the system shutdown function) and seek professional help. It is quite possible and even probable that, if you follow any of the steps described below without fully understanding them, you will worsen your situation.
Failing drives
In the area of data recovery, it is best to work on images of disks rather than physical disks themselves. Generally, a failing drive's condition worsens over time. The goal ought to be to first rescue as much data as possible as early as possible in the failure of the disk and to then abandon the disk. The ddrescue and dd_rescue utilities, unlike
dd
, will repeatedly try to recover from errors and will read the drive front to back, then back to front, attempting to salvage data. They keep log files so that recovery can be paused and resumed without losing progress.See Disk cloning.
The image files created from a utility like ddrescue can then be mounted like a physical device and can be worked on safely. Always make a copy of the original image so that you can revert if things go sour!
A tried and true method of improving failing drive reads is to keep the drive cold. A bit of time in the freezer is appropriate, but be careful to avoid bringing the drive from cold to warm too quickly, as condensation will form. Keeping the drive in the freezer with cables connected to the recovering PC works great.
Do not attempt a filesystem check on a failing drive, as this will likely make the problem worse. Mount it read-only.
Backup flash media/small partitions
As an alternative to working with a 'live' partition (mounted or not), it is often preferable to work with an image, provided that the filesystem in question is not too large and that you have sufficient free HDD space to accommodate the image file. For example, flash memory devices like thumb drives, digital cameras, portable music players, cellular phones, etc. are likely to be small enough to image in many cases.
Be sure to read the man pages for the utilities listed below to verify that they are capable of working with image files.
To make an image, one can use
dd
as follows:Working with digital cameras
In order for some of the utilities listed in the next section to work with flash media, the device in question needs to be mounted as a block device (i.e., listed under /dev). Digital cameras operating in PTP (Picture Transfer Protocol) mode will not work in this regard. PTP cameras are transparently handled by libgphoto and/or libptp. In this case, 'transparently' means that PTP devices do not get block devices. The alternative to PTP mode, USB Mass Storage (UMS) mode, is not supported by all cameras. Some cameras have a menu item that allows switching between the two modes; refer to your camera's user manual. If your camera does not support UMS mode and therefore cannot be accessed as a block device, your only alternative is to use a flash media reader and physically remove the storage media from your camera.
List of utilities
See also Wikipedia:List of data recovery software#File Recovery
- dvdisaster — Additional error protection for CD/DVD media.
- https://sourceforge.net/projects/dvdisaster/ || dvdisasterAUR
- ext4magic — recover deleted or overwritten files on ext3 and ext4 filesystems.
- http://sourceforge.net/projects/ext4magic/ || ext4magic
- extundelete — Utility for recovering deleted files from ext2, ext3 or ext4 partitions by parsing the journal.
- http://extundelete.sourceforge.net/ || extundelete
- Foremost — Console program to recover files based on their headers, footers, and internal data structures. This process is commonly referred to as data carving. The headers and footers can be specified by a configuration file or command line switches can be used to specify built-in file types.
- http://foremost.sourceforge.net/ || foremost
- PhotoRec — File data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory.
- https://www.cgsecurity.org/ || testdisk
- Scalpel — File carving and indexing application originally based on Foremost, although significantly more efficient. It allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media.
- https://github.com/sleuthkit/scalpel || scalpel-gitAUR
- TestDisk — Data recovery software primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table).
- https://www.cgsecurity.org/ || testdisk
Extundelete
Extundelete is a terminal-based utility designed to recover deleted files from ext3 and ext4 partitions. It can recover all the recently deleted files from a partition and/or a specific file(s) given by relative path or inode information. Note that it works only when the partition is unmounted. The recovered files are saved in the current directory under the folder named
RECOVERED_FILES/
.Installation
extundelete is available in the official repositories.
Usage
Derived from the post on Linux Poison.
To recover data from a specific partition, the device name for the partition, which will be in the format
/dev/sdXN
(X is a letter and N is a number.), must be known. The example used here is /dev/sda4
, but your system might use something different (For example, MMC card readers use /dev/mmcblkNpN
as their naming scheme.) depending on your filesystem and device configuration. If you are unsure, run df
, which prints currently mounted partitions.Once which partition data is to be recovered from has been determined, simply run:
Any subdirectories must be specified, and the command runs from the highest level of the partition, so, to recover a file in
/home/SomeUserName/
, assuming /home
is on its own partition, run:To speed up multi-file recovery, extundelete has a
--restore-files
option as well.To recover an entire directory, run:
For advanced users, to manually recover blocks or inodes with extundelete, debugfs can be used to find the inode to be recovered; then, run:
inode stands for any valid inode. Additional inodes to recover can be listed in an unspaced, comma-separated fashion.
Finally, to recover all deleted files from an entire partition, run:
Ext4Magic
ext4magic is another recovery tool for the ext3 and ext4 file system.
To recover all files, deleted in the last 24 hours:
To recover a directory or file:
The small R flag
-r
will only recover complete files, that were not overwritten. To also recover broken files, that were partially overwritten, use the big R flag -R
. This will also restore not-deleted files and empty directories.The default destination is
./RECOVERDIR
which can be changed by adding the option -d path/to/dest/dir
.If a file exists in the destination directory, the new file is renamed with a trailing hash sign
#
.To recover files deleted after 'five days ago':
To use a file list:
The difference between the big L flag
-L
and the small L flag -l
is the same as between the two R flags -R
and -r
(see above).Use
grep -a
to preserve binary file names.Using a file list allows to filter the files, for example by file extension:
.. or to split the file list:
Testdisk and PhotoRec
TestDisk and Photorec are both open-source data recovery utilities licensed under the terms of the GNU Public License (GPL).
TestDisk is primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses, or human error, such as the accidental deletion of partition tables.
PhotoRec is file recovery software designed to recover lost files including photographs (Hint: PhotographRecovery), videos, documents, archives from hard disks and CD-ROMs. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even with a re-formatted or severely damaged filesystems and/or partition tables.
Installation
Install the testdisk package, which provides both TestDisk and PhotoRec.
Usage
After running e.g. ddrescue to create image.img,
photorec image.img
will open a terminal UI where you can select what file types to search for and where to put the recovered files.Files recovered by photorec
The photorec utility stores recovered files with a random names(for most of the files) under a numbered directories, e.g.
./recup_dir.1/f872690288.jpg
, ./recup_dir.1/f864563104_wmclockmon-0.1.0.tar.gz
. See also
- How to get the original filenames: PhotoRec FAQ
- Wiki (TestDisk): http://www.cgsecurity.org/wiki/TestDisk
- Wiki (Photorec): http://www.cgsecurity.org/wiki/PhotoRec
- Homepage: http://www.cgsecurity.org/
e2fsck
e2fsck is the ext2/ext3 filesystem checker included in the base install of Arch. e2fsck relies on a valid superblock. A superblock is a description of the entire filesystem's parameters. Because this data is so important, several copies of the superblock are distributed throughout the partition. With the
-b
option, e2fsck can take an alternate superblock argument; this is useful if the main, first superblock is damaged.To determine where the superblocks are, run
dumpe2fs -h
on the target, unmounted partition. Superblocks are spaced differently depending on the filesystem's blocksize, which is set when the filesystem is created.An alternate method to determine the locations of superblocks is to use the -n option with mke2fs. Be sure to use the
-n
flag, which, according to the mke2fs
manpage, 'Causes mke2fs to not actually create a filesystem, but display what it would do if it were to create a filesystem. This can be used to determine the location of the backup superblocks for a particular filesystem, so long as the mke2fs parameters that were passed when the filesystem was originally created are used again. (With the -n option added, of course!)'.Installation
Both
e2fsck
and dumpe2fs
are included in the base Arch install as part of e2fsprogs.See also
- e2fsck man page: http://phpunixman.sourceforge.net/index.php/man/e2fsck/8
- dumpe2fs man page: http://phpunixman.sourceforge.net/index.php?parameter=dumpe2fs&mode=man
Working with raw disk images
This article or section is a candidate for merging with QEMU.
Notes:please use the second argument of the template to provide more detailed indications. (Discuss in Talk:File recovery#)
If you have backed up a drive using ddrescue or dd and you need to mount this image as a physical drive, see this section.
Mount the entire disk
To mount a complete disk image to the next free loop device, use the
Tip:losetup
command:- The
-f
flag mounts the image to the next available loop device. - The
-P
flag creates additional devices for every partition.
See also more information about loop devices.
Mounting partitions
Install Testdisk
In order to be able to mount a partiton of a whole disk image, follow the steps above.
Once the whole disk image is mounted, a normal
mount
command can be used on the loop device:This command mounts the first partition of the image in loop0 to the folder to the mountpoint
/mnt/example
. Remember that the mountpoint directory must exist!Getting disk geometry
Once the entire disk image has been mounted as a loopback device, its drive layout can be inspected.
Using QEMU to Repair NTFS
Install Testdisk On Linux
With a disk image that contains one or more NTFS partitions that need to be
chkdsk
ed by Windows since no good NTFS filesystem checker for Linux exists, QEMU can use a raw disk image as a real hard disk inside a virtual machine:Then, assuming Windows is installed on
primary.img
, it can be used to check partitions on /path/to/DamagedDisk.img
.Warning: Do not use lower version of Windows to check NTFS partitions create by higher version of it, e.g. Windows XP can do damage to NTFS partitions created by Windows 8 by 'fixing' metadata configuration that has support for, not supported entries will be removed or miss-configured.
Text file recovery
Install Testdisk Ubuntu
It is possible to find deleted plain text files on a hard drive by directly searching on the block device. A preferably unique string from the file you are trying to recover is needed.
Use
grep
to search for fixed strings (-F
) directly on the partition:Install Testdisk Ubuntu 18.04
Hopefully, the content of the deleted file is now in OutputFile, which can be extracted from the surrounding context manually.
Install Test Disk In Linux Mint
Note: The
-C 200
option tells grep to print 200 lines of context from before and after each match of the string. Alternatives are the -A
and -B
flags, which print context only from after and before each match, respectively. You may need to adjust the number of lines if the file you are looking for is very long.See also
- Data Recovery on the Ubuntu wiki
Retrieved from 'https://wiki.archlinux.org/index.php?title=File_recovery&oldid=568847'