====== Data rescue / recovery ======
Getting files and other data back which were deleted. The opposite of [[wipe|wiping]] files.

===== Tools =====
  * ddrescue, confusingly, can refer to two completely separate programs, GNU ddrescue and dd_rescue by Kurt Garloff.
    * Both have the same purpose and are actively developed – versions as of 8/2023:\\ dd_rescue: 1.99.13-2\\ GNU ddrescue: 1.27-1
    * Several sources **prefer GNU ddrescue** over dd_rescue[([[http://lwn.net/Articles/430000/]]: //"ddrescue wins (in my book) because it is an efficient self-contained program written in C++ (not a shell script kludge), produces much cleaner output on the console/terminal, and (most importantly) handles unreadable blocks gracefully and intelligently."//)].
  * photorec (often in the package ''testdisk'')
  * testdisk – get partitions back
  * scalpel – forensic file retrieval
  * foremost – forensic file retrieval, mostly compatible with scalpel, slightly newer and different results.

===== SMART =====

HDDs often show pending sectors before they fail:
<code>
smartctl -x /dev/sdc | grep Sector
</code>

===== NTFS =====

<code>
rsync -a --info=progress2 /path/to/mounted/ntfs/partition /path/to/target
ntfsclone --rescue --save-image --output - /dev/sdXX1 | xz -1 -cv > output-image.xz
</code>

===== further information =====
  * [[https://wiki.archlinux.org/index.php/File_recovery|Arch Wiki "File recovery"]]