Tip of the Trade: TestDisk and PhotoRec
Murphy's Law dictates that you can always count on Bad Things happening. That probably explains why the software world has so many different recovery utilities for accidentally (or purposely) deleted files. These vary in ease of use, though typically "easy" is not a word that applies. Except for a pair of excellent data recovery tools, TestDisk and PhotoRec. (That's "rec" as in "recovery," not "wreck".) With TestDisk and PhotoRec, recovering deleted files is a snap. TestDisk recovers mangled partitions, and PhotoRec recovers lost files of all types.
TestDisk recovers mangled partitions, and PhotoRec recovers lost files of all types, not just image files, as the name implies. The tools run on DOS, all versions of Windows, Linux, FreeBSD, NetBSD, OpenBSD, Sun Solaris, and Mac OSX. Additionally, they should compile and run on most any Unix system.
My personal favorite way to run TestDisk or PhotoRec is from a bootable Linux CD. They are included on Knoppix, Trinity Rescue Kit and RIPLinux. Virtually all filesystems and partition types are supported as well. There are a number of ways to rescue data:
- Copy the files to a separate partition on the same hard drive
- Copy the files to a separate hard drive on the same machine
- Copy the files to a USB-attached storage device
- Copy the files to a networked drive
- Make a hard drive image with ddrescue, then work from that. This is a nice safety net, since it does not affect the original partition or drive.
Be sure to allow plenty of drive space for the recovery. The minimum recommendation is the same size as the partition you're trying to recover, plus 10 percent. The partition you want to recover must not be mounted, but the partition to which you're recovering the files must be.
A bootable rescue CD works well here, as it eliminates the hassle of dealing with mount problems caused by the root filesystem and data files being on a single partition or other complications. Using a rescue CD and a USB flash drive together works great. You can also hack up any of these rescue Linux distros to boot from a USB drive, although you'll want to test this thoroughly because some BIOSes are buggy and don't handle USB booting very well.
Visit cgsecurity.org for documentation and downloads.