Data rescue / recovery

Getting files and other data back which were deleted. The opposite of wiping files.

Tools

ddrescue, confusingly, can refer to two completely separate programs, GNU ddrescue and dd_rescue by Kurt Garloff.
- Both have the same purpose and are actively developed – versions as of 8/2023:
  dd_rescue: 1.99.13-2
  GNU ddrescue: 1.27-1
- Several sources prefer GNU ddrescue over dd_rescue¹.
photorec (often in the package testdisk)
testdisk – get partitions back
scalpel – forensic file retrieval
foremost – forensic file retrieval, mostly compatible with scalpel, slightly newer and different results.

SMART

HDDs often show pending sectors before they fail:

smartctl -x /dev/sdc | grep Sector

NTFS

rsync -a --info=progress2 /path/to/mounted/ntfs/partition /path/to/target
ntfsclone --rescue --save-image --output - /dev/sdXX1 | xz -1 -cv > output-image.xz

further information

Arch Wiki "File recovery"

^[1] http://lwn.net/Articles/430000/: "ddrescue wins (in my book) because it is an efficient self-contained program written in C++ (not a shell script kludge), produces much cleaner output on the console/terminal, and (most importantly) handles unreadable blocks gracefully and intelligently."

Table of Contents

Data rescue / recovery

Tools

SMART

NTFS

further information