Data is the crucial bit in our personal and professional existence. Without data we would be lost in a vast expanse of nothingness. Spreadsheets, email, documents, contacts, databases, files, folders … the list goes on and on. In a perfect world, every byte of local storage would be backed up to an external hard drive or cloud storage service.
We don’t always live in a perfect world.
Sometimes data has to be recovered. When that tragedy strikes, it’s good to know you have the tools on hand to get the job done. Thankfully, Linux is no stranger to data recovery. In fact, there are a number of solid tools you can use to get back lost data. I want to introduce you to a few tools that do a great job of recovering data.
Of course, as with any instance of recovering lost data ─ nothing is perfect. You can try any of the various tools available only to find the data simply not recoverable. That is the nature of the digital age. To that end, always make sure you have a solid, recent backup available in the event your system goes down hard.
SystemRescueCD
Let’s first start with tools to help you recover data from a downed machine (say a machine with file system or partition issues). These tend to be the easiest to work with as they are all-inclusive tools. My favorite of these tools is SystemRescueCD. This particular rescue CD supports most of the known partition formats and includes all the tools you need to recover data (including sfdisk, Gparted, TestDisk, PhotoRec, FSArchiver, and much more) and includes plenty of tools to work with.
Like most rescue disks, SystemRescueCD works by booting your system from either the CD or USB drive and then uses the tools to work with your file system. Unlike a lot of other rescue tools of this nature, SystemRescueCD offers a full-blown graphical environment to aid you in the task of recovering data (Figure 1).
If you are rescuing data from one machine to another, you will need to attach an external hard drive to the system in order to move the rescued data (or you can use the built-in Samba support and copy data to a networked location). If the idea is to recover or repair a partition table, I strongly suggest copying sensitive data over over anyway ─ on the chance the partition table or file system is further damaged.
There are other rescue systems available that are similar in both intent and style as SystemRescueCD. Each has its pros and cons but, in the end, will get the job done. Some of my favorite Linux data/system recovery distributions include:
Individual rescue tools
Once you get beyond a full-blown distribution, you start looking at purpose-driven tools geared toward recovering data. Linux has just about any tool you need for this task. Let’s take a look at some of them.
Ddrescue
If you’re looking for the command line tool that will copy data from one file or block device to another, it’s Ddrescue that you need. There are a few things you should know about using the Ddrescue:
-
Never use this tool on a read/write mounted drive or partition.
-
Do not try to repair a file system with I/O errors.
-
Destination will be overwritten ─ so make sure destination is free of important data.
This tool is great for recovering data from a failing drive to an external source. You would first need to install the tool on your working system, attach both the failing drive and a destination drive, via USB, and use the tool to extract the necessary data.
Installing the tool on an Ubuntu system can be done with a single command:
sudo apt-get install gddrescue
The command structure of Ddrescue is:
ddrescue [options] infile outfile [logfile]
Let’s use Ddrescue to copy a partition from drive /dev/sdg to drive /dev/sdb. The command (run on a system that works with sudo) would look like:
sudo ddrescue /dev/sdg /dev/sdb
The above command would copy everything from the failing source to the healthy target. Data recovered!
Testdisk
This particular data recovery tool doesn’t actually try to copy data. Instead it attempts to correct partition-level issues that might be preventing you from accessing or recovering your data. Testdisk can:
-
Recover lost partitions
-
Make disks bootable again
-
Fix a partition table
-
Restore the master boot record
-
Restore boot sectors
-
Restore filesystem tables
-
Undelete files from NTFS, FAT, exFAT, and ext2 filesystems
-
Copy files from deleted NTFS, FAT, exFAT, and ext2/3/4 filesystems.
Testdisk is an ncurses tool that runs within a terminal (Figure 2).
To install Testdisk on an Ubuntu system, issue the command:
sudo apt-get install testdisk
Run the tool with sudo testdisk and walk through the easy-to-use wizard for working with your externally attached drive.
Photorec
If you’re looking to recover lost files, photos, videos, etc. Photorec is what you want. This tool is part of Testdisk, so once you’ve installed Testdisk, Photorec is ready to serve. This particular tool completely ignores the file system and looks directly at the underlying data. This means, if your file system is damaged, there’s a chance the data can still be recovered.
To start Photorec, issue the command:
sudo photorec
The interface for Photorec is similar to that of Testdisk. As Photorec works, it will display, in real time, what types of files it has recovered (Figure 3).
You do want to make sure the destination partition has enough space to contain the rescued data (you can copy the data to internal storage or external storage).
If you are looking for tools to help you recover data on a Linux system, there are plenty to be had. This post offers you a look into what is available for admins to use ─ from full-blown disk recovery suites to individual tools. There are plenty of other tools ready to aid you in your quest to recover data.
For more information on such tools, check out the Linux.com System Management Forum, where you can interact with your peers and learn even more about data recovery.
