Data rescue / recovery
Getting files and other data back which were deleted. The opposite of wiping files.
Tools
- ddrescue, confusingly, can refer to two completely separate programs, GNU ddrescue and dd_rescue by Kurt Garloff.
- Both have the same purpose and are actively developed – versions as of 8/2023:
dd_rescue: 1.99.13-2
GNU ddrescue: 1.27-1 - Several sources prefer GNU ddrescue over dd_rescue1.
- photorec (often in the package
testdisk) - testdisk – get partitions back
- scalpel – forensic file retrieval
- foremost – forensic file retrieval, mostly compatible with scalpel, slightly newer and different results.
SMART
HDDs often show pending sectors before they fail:
smartctl -x /dev/sdc | grep Sector
NTFS
rsync -a --info=progress2 /path/to/mounted/ntfs/partition /path/to/target ntfsclone --rescue --save-image --output - /dev/sdXX1 | xz -1 -cv > output-image.xz
further information
[1]
http://lwn.net/Articles/430000/: "ddrescue wins (in my book) because it is an efficient self-contained program written in C++ (not a shell script kludge), produces much cleaner output on the console/terminal, and (most importantly) handles unreadable blocks gracefully and intelligently."