Easy way to recover deleted files

I will share a small find, a small program for recovering deleted files. Some time ago it was very necessary, but the program Scalpel , then did not find, unfortunately. In my opinion, of all the methods known to me, this is one of the simplest. Scalpel emerged from the Foremost project.

And so rm -rf lovers are dedicated to:


')
First of all, the most important thing is that no one guarantees that Scalpel will be able to recover your files, but there are chances for that.

Installation (since Ubuntu is on the test machine, I will talk about it):

sudo apt-get install scalpel

Then you can smoke mana (useful):

man scalpel

Before using Scalpel, edit the settings file:

sudo nano /etc/scalpel/scalpel.conf

It is necessary to specify the files, what type we will restore (by default, not one type is selected). I selected doc and pdf files for recovery:

...
doc y 10000000 \ xd0 \ xcf \ x11 \ xe0 \ xa1 \ xb1 \ x1a \ xe1 \ x00 \ x00 \ xd0 \ xcf \ x11 \ xe0 \ xa1 \ xb1 \ x1a \ xe1 \ x00 \ x00 NEXT
doc y 10000000 \ xd0 \ xcf \ x11 \ xe0 \ xa1 \ xb1
...
pdf y 5000000% PDF% EOF \ x0d REVERSE
pdf y 5000000% PDF% EOF \ x0a REVERSE
...

Now you can run a restore:

scalpel / dev / sda1 -o output

-o shows the directory where the recovered files will be added if the directory with the same name already exists (and is not empty). Scalpel will not start.
/ dev / sda1 is the actual volume that will be wool for lost files.
The list can be viewed using the mount command:

username @ host: ~ $ mount
/ dev / sda1 on / type ext3 (rw, relatime, errors = remount-ro)
proc on / proc type proc (rw, noexec, nosuid, nodev)
/ sys on / sys type sysfs (rw, noexec, nosuid, nodev)
varrun on / var / run type tmpfs (rw, noexec, nosuid, nodev, mode = 0755)
udev on / dev type tmpfs (rw, mode = 0755)
devshm on / dev / shm type tmpfs (rw)
devpts on / dev / pts type devpts (rw, gid = 5, mode = 620)
lrm on /lib/modules/2.6.24–21-generic/volatile type tmpfs (rw)
/ dev / sda2 on / home type ext3 (rw, relatime)

After working out, go to the output directory and see what is there:

username @ host: ~ / output $ ls -l
-rw-rr-- 1 root root 28189 2009–03–24 14:42 audit.txt
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 doc-3–0
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 doc-3–1
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 doc-3–2
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 doc-4–0
...
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 pdf-5–0
drwxr-xr-x 2 root root 4096 2009–03–24 14:42 pdf-6–0
...

The audit.txt file contains the information about the recovery performed:

username @ host: ~ / output $ cat audit.txt

Scalpel version 1.60 audit file
Started at Tue Mar 24 14:16:04 2009
Command line:
scalpel / dev / sda1 -o output

Output directory: / home / username / output
Configuration file: /etc/scalpel/scalpel.conf

Opening target "/ dev / sda1"

The following files were carved:
File Start Chop Length Extracted From
00053045.doc 183664640 YES 10,000,000 sda1
00053046.doc 183971840 YES 10000000 sda1
...
00050372.doc 203272192 NO 208896 sda1
00050373.doc 203481088 NO 229376 sda1
...
Completed at Tue Mar 24 14:42:41 2009

We look in the subdirectories and see (if lucky) our files:

username @ host: ~ / output / doc-3–0 $ ls -l
total 25564
-rw-rr-- 1 root root 307200 2009–03–24 14:42 00050348.doc
-rw-rr-- 1 root root 40960 2009–03–24 14:42 00050349.doc
-rw-rr-- 1 root root 4354 2009–03–24 14:42 00050350.doc
-rw-rr-- 1 root root 466686 2009–03–24 14:42 00050351.doc
-rw-rr-- 1 root root 176128 2009–03–24 14:42 00050352.doc
...

Source - HowtoForge (free translation).

I will add from myself Scalpel recovered not all, of course. But a lot, I even forgot about some files. It does not work very quickly, eats almost the entire processor during operation.

Scalpel can work with FAT, NTFS, ext 2/3 file systems, that is, you can recover data from win-partitions.

And finally, the best way to recover very important files is:
1. Make backups.
2. It is very good to think before deleting.

Successful data recovery!