Data Recovery

From Indie IT Wiki

Introduction

Deleted or lost files can sometimes be recovered from failed or formatted drives and partitions, CD-ROMs and memory cards using the free/libre software available in the Ubuntu repositories. The data is recoverable because the information is not immediately removed from the disk. Follow these steps to recover lost data.

Caution

You should NOT write to the failed device, as it can worsen a hardware failure, and overwrite existant data in case of lost files.

Shut down the affected machine as soon as possible, and restart it from a LiveCD or LiveUSB. Be certain that the "live" cd does not automatically mount any partition or swap space.

TestDISK Partition Recovery

Introduction...

NAME
      testdisk - Scan and repair disk partitions

SYNOPSIS
      testdisk [/log] [/debug] [/dump] [device|image.dd|image.e01]

      testdisk /version

      testdisk /list [/log]

DESCRIPTION
         TestDisk checks and recovers lost partitions
         It works with :
         - BeFS (BeOS)
         - BSD disklabel (FreeBSD/OpenBSD/NetBSD)
         - CramFS, Compressed File System
         - DOS/Windows FAT12, FAT16 and FAT32
         - HFS and HFS+, Hierarchical File System
         - JFS, IBM's Journaled File System
         - Linux ext2/ext3/ext4
         - Linux Raid
           RAID 1: mirroring
           RAID 4: striped array with parity device
           RAID 5: striped array with distributed parity information
           RAID 6: striped array with distributed dual redundancy information
         - Linux Swap (versions 1 and 2)
         - LVM and LVM2, Linux Logical Volume Manager
         - Mac partition map
         - Novell Storage Services NSS
         - NTFS (Windows NT/2K/XP/2003/Vista/...)
         - ReiserFS 3.5, 3.6 and 4
         - Sun Solaris i386 disklabel
         - Unix File System UFS and UFS2 (Sun/BSD/...)
         - XFS, SGI's Journaled File System

Install the software...

sudo aptitude install testdisk

Run...

sudo testdisk /dev/sdX

Thanks - http://www.dedoimedo.com/computers/linux-data-recovery.html

DDRescue Latest Version

Your Linux distro will probably not have the latest stable version, so just download it and it will install in /usr/local/bin...

sudo aptitude install lzip
curl http://ftp.heanet.ie/mirrors/gnu/ddrescue/
wget http://ftp.heanet.ie/mirrors/gnu/ddrescue/ddrescue-1.19.tar.lz
tar --lzip -xvf ddrescue-1.19.tar.lz
cd ddrescue-1.19/
./configure
make
sudo make install
/usr/local/bin/ddrescue --version

http://ftp.heanet.ie/mirrors/gnu/ddrescue/

Backup Single Partition To Local Disk

/usr/local/bin/ddrescue -d /dev/hda1 imagefile logfile

Backup Whole Disk To Local Disk

/usr/local/bin/ddrescue -d /dev/hda imagefile logfile

Backup Single Partition To Network Server

On the server...

nc -l 12345 | pv -b -p -s 263m > laptop_hda1.img

Next we tell the client to begin copying data to the server.

On the client...

sudo dd if=/dev/hda1 | nc 192.168.140.11 12345

Backup Whole Disk To Network Server

On the server...

nc -l 12345 | pv -b -p -s 263m > laptop_hda.img

Next we tell the client to begin copying data to the server.

On the client...

sudo dd if=/dev/hda | nc 192.168.140.11 12345

https://nfolamp.wordpress.com/2010/06/14/performing-backups-with-netcat/

Mounting A Drive Image

METHOD A

Kpartx: a tool for mounting partitions within an image file

Kpartx can be used to set up device mappings for the partitions of any partitioned block device. It is part of the Linux multipath-tools. With kpartx -l imagefile you get an overview of the partitions in the image file and with kpartx -a imagefile the partitions will accessible via /dev/mapper/loop0pX (X is the number of the partition). You can mount it now with mount /dev/mapper/loop0pX /mnt/ -o loop,ro. After unmounting you can disconnect the mapper devices with kpartx -d imagefile.

https://nfolamp.wordpress.com/2010/08/16/mounting-raw-image-files-and-kpartx/

METHOD B

Check the drive image...

file harddrive.img

harddrive.img: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3, stage2 
address 0x2000, stage2 segment 0x200, GRUB version 0.97; partition 1: ID=0x83, 
active, starthead 1, startsector 63, 33640047 sectors, code offset 0x48

Examine the drive image...

fdisk -l harddrive.img
                   Device Boot      Start         End      Blocks   Id  System
harddrive.img                *          63    33640109    16820023+  83  Linux

Since we need to go 63 sectors ahead, and each sector is 512 bytes long, we need to use an offset of 32,256 bytes.

mount -o ro,loop,offset=32256 harddrive.img /mnt/loop
mount | grep harddrive.img
/root/harddrive.img on /mnt/loop type ext3 (ro,loop=/dev/loop1,offset=32256)

If you made this image under duress (due to a failing drive or other emergency), you might have to check and repair the filesystem first. Doing that is easy if you make a loop device:

losetup --offset 32256 /dev/loop2 harddrive.img
fsck /dev/loop2

Once that’s complete, you can save some time and mount the loop device directly:

mount /dev/loop2 /mnt/loop

Thanks - https://major.io/2010/12/14/mounting-a-raw-partition-file-made-with-dd-or-dd_rescue-in-linux/

Fix MSDOS VFAT File System SD Card

sudo fsck.vfat -l -v -a -t /dev/sdx1

Thanks - https://help.ubuntu.com/community/FilesystemTroubleshooting

Fix Linux EXT4 File System SD Card

sudo fsck.ext4 -c -y -f -v -C0 /dev/sdx2

https://help.ubuntu.com/community/FilesystemTroubleshooting

Links

https://help.ubuntu.com/community/DataRecovery

https://www.technibble.com/guide-using-ddrescue-recover-data/

https://www.elcomsoft.com/