undelete files using testdisk – data recovery [debian, ubuntu]

based on:
http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_FAT

TestDisk can undelete files from FAT, NTFS, exFAT and ext2 filesystem.

install testdisk:
sudo apt-get install testdisk

do a backup of the drive and work with the backup: #so testdisk will not harm the orginal data
based on:
http://hydra.geht.net/tino/howto/linux/recover/
find your device with (i will use in this example sdc1):
dmesg
dd if=/dev/sdc1 of=sdc1-image bs=1M status=progress conv=noerror,sync
or if the partitioning is gone:
dd if=/dev/sdc of=sdc-image bs=1M status=progress conv=noerror,sync

useage testdisk:
sudo testdisk
No Log “enter”
choose your hard drive with arrow-up and arrow-down(for example your connected usb stick /
you get more info about your drives and partitionstable with running in terminal lsblk)
Proceed “enter”
select the default partitionstable with “enter”
Advanced “enter”
Undelete “enter”
arrow-left to move out of folder, arrow-right to move in folder
move to directory (h to hide/unhide deleted files)
mark a deleted file with arrow up and down and copy it with pressing c(the deleted ones are marked red)
choose your destination
if destination is correct press c
done 🙂

exit testdisk:
press a lot of times q

using photorec: #i think it will be installed with testdisk
sudo photorec
sudo photorec dd_partition_image.img

other programs:
foremost:
http://foremost.sourceforge.net/
sudo apt-get install foremost

ddrescue:
sudo apt-get install gddrescue
ddrescue -d /dev/SRCDEV DEST.img DEST.log

http://hydra.geht.net/tino/howto/linux/recover/ddrescue/
http://linuxvoodoo.de/2015/05/linux-ddrescue/ #recover broken music cd

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s