admin:recovery

Data rescue / recovery

Getting files and other data back which were deleted. The opposite of wiping files.

  • ddrescue, confusingly, can refer to two completely separate programs, GNU ddrescue and dd_rescue by Kurt Garloff.
    • Both have the same purpose and are actively developed – versions as of 8/2023:
      dd_rescue: 1.99.13-2
      GNU ddrescue: 1.27-1
    • Several sources prefer GNU ddrescue over dd_rescue1.
  • photorec (often in the package testdisk)
  • testdisk – get partitions back
  • scalpel – forensic file retrieval
  • foremost – forensic file retrieval, mostly compatible with scalpel, slightly newer and different results.

HDDs often show pending sectors before they fail:

smartctl -x /dev/sdc | grep Sector
rsync -a --info=progress2 /path/to/mounted/ntfs/partition /path/to/target
ntfsclone --rescue --save-image --output - /dev/sdXX1 | xz -1 -cv > output-image.xz

[1] http://lwn.net/Articles/430000/: "ddrescue wins (in my book) because it is an efficient self-contained program written in C++ (not a shell script kludge), produces much cleaner output on the console/terminal, and (most importantly) handles unreadable blocks gracefully and intelligently."
  • Last modified: 2023-08-26 15:58