Applied necromancy in Linux or return deleted files from non-existence
I think each of us encountered a problem when, due to a glitch of the camera firmware, camera, PDA, smartphone, or simply because of a special / dev / hands device, the card was formatted, the data was deleted. At one time, I solved this problem quite simply, using the Portable version of Ontrack Easy Recovery, but since I have been a linux user for several years, using this unlicensed application through wine seemed not exactly kosher, and the thirst for research and adventure required finding a free native analog for linux systems. The research ended, even before it began, as the first line in Google search led to a set of utilities TestDisk, which I will discuss in more detail later.
And so, TestDist consists of two utilities:
testdisk and photorec; Official site utilities .
Short description:
testdisk is a powerful utility designed to recover deleted partitions and to restore mbr boot records after program errors, actions of some viruses, human errors (for example, when a section was simply deleted).
Testdisk features :
Correction of the partition table; recover deleted partitions Recover FAT32 boot sector from backup Rebuild FAT12 / FAT16 / FAT32 boot sector Fix FAT tables
Rebuilding NTFS boot sector Recover NTFS boot sector from backup MFT fix using MFT mirror Finding ext2 / ext3 Backup SuperBlock
Recover deleted files in FAT, NTFS and ext2 file systems
Copy files from FAT, NTFS and ext2 / ext3 deleted partitions.
photorec is a data recovery utility such as video files, documents, archives from hard disks and cdrom disks, as well as photos (therefore the name of the program Photo Recovery) from the built-in memory of cameras. The list of file types for recovery is quite impressive and can be found here .
Both open source utilities are distributed under the GNU General Public License (GPL). Available in versions for linux, unix, as well as for windows platforms.
')
In most Linux distributions are already included in the standard repository. For debian-based distributions, install with the command:
In my case, it was necessary to recover photos from the camera card after the camera accidentally formatted the card. After inserting the USB flash drive into the card reader and running photorec in the console with the rights of the root, the utility suggested that I choose a disk on which to restore the data.
In my case it will be / dev / sdb .
Next, select the type of partition table on the disk, for most users it will be Intel / PC.
And then select the entire partition or disk to search for deleted files. Since I needed to recover all deleted files after formatting, I chose to search the entire disk.
After this photorec you need to specify the type of file system in which the deleted files were stored. In this case, everything is simple, choose the second item.
And then on another disk, select the directory where the utility will save the recovered files.
Next, press Y and the program starts its work. For a 32MB card, it took less than a minute.
Now about the results of the work:
To be honest, at first I highly doubted the abilities of the program. But having opened the utility results directory, I was surprised to find that not only the recently taken 10 photos needed were restored, but also 110 others, the earliest of which was taken 3 years ago and was not overwritten with further use of the card, although it was formatted card repeatedly.
As a result, we have another victory of good over evil, a happy smile of the owner of the camera, another fact proving that there is a sea of useful and high-quality opensource utilities.
And so, TestDist consists of two utilities:
testdisk and photorec; Official site utilities .
Short description:
testdisk is a powerful utility designed to recover deleted partitions and to restore mbr boot records after program errors, actions of some viruses, human errors (for example, when a section was simply deleted).
Testdisk features :
Correction of the partition table; recover deleted partitions Recover FAT32 boot sector from backup Rebuild FAT12 / FAT16 / FAT32 boot sector Fix FAT tables
Rebuilding NTFS boot sector Recover NTFS boot sector from backup MFT fix using MFT mirror Finding ext2 / ext3 Backup SuperBlock
Recover deleted files in FAT, NTFS and ext2 file systems
Copy files from FAT, NTFS and ext2 / ext3 deleted partitions.
photorec is a data recovery utility such as video files, documents, archives from hard disks and cdrom disks, as well as photos (therefore the name of the program Photo Recovery) from the built-in memory of cameras. The list of file types for recovery is quite impressive and can be found here .
Both open source utilities are distributed under the GNU General Public License (GPL). Available in versions for linux, unix, as well as for windows platforms.
')
In most Linux distributions are already included in the standard repository. For debian-based distributions, install with the command:
sudo aptitude install testdisk
In my case, it was necessary to recover photos from the camera card after the camera accidentally formatted the card. After inserting the USB flash drive into the card reader and running photorec in the console with the rights of the root, the utility suggested that I choose a disk on which to restore the data.
In my case it will be / dev / sdb .
Next, select the type of partition table on the disk, for most users it will be Intel / PC.
And then select the entire partition or disk to search for deleted files. Since I needed to recover all deleted files after formatting, I chose to search the entire disk.
After this photorec you need to specify the type of file system in which the deleted files were stored. In this case, everything is simple, choose the second item.
And then on another disk, select the directory where the utility will save the recovered files.
Next, press Y and the program starts its work. For a 32MB card, it took less than a minute.
Now about the results of the work:
To be honest, at first I highly doubted the abilities of the program. But having opened the utility results directory, I was surprised to find that not only the recently taken 10 photos needed were restored, but also 110 others, the earliest of which was taken 3 years ago and was not overwritten with further use of the card, although it was formatted card repeatedly.
As a result, we have another victory of good over evil, a happy smile of the owner of the camera, another fact proving that there is a sea of useful and high-quality opensource utilities.
Source: https://habr.com/ru/post/77271/
All Articles