Ubuntu data recovery. Data Recovery Software for Linux

Sometimes it happens that we delete, as it would seem not necessary files(images, videos, text documents etc.), and then suddenly we regret it, because... Among the deleted ones, the necessary ones turned out to be. It's good if we delete files in Cart, from where it is very easy to restore by pressing the key combination Ctrl+Z and then all the files that are in Cart will be restored to their previous folders or you can selectively by right-clicking on the desired file in Cart and in the context menu - Restore.

But what to do when we deleted files with the function - Delete permanently? Many people believe that the data is lost forever. But that's not true. In this case, the console utility will help us Scalpel.

Scalpel is a simple, highly effective file recovery tool.
Scalpel is a remedy quick recovery files, which reads the beginning and end of files of known formats from the database and tries to find them on disk. The uniqueness of this software is that it does not depend on file system. Therefore, restoration is possible with both FATx, NTFS, ext2/3, so with "bare" (raw) sections. The tool can be used for both digital information retrieval and file recovery.

Scalpel available in the repositories of almost all distributions Linux. IN Ubuntu and derivatives you can install it from Application Center or run the command in the terminal to install:

sudo apt-get install scalpel

After installation you will not find it in the system menu Scalpel, because I mentioned above, this tool is launched from the terminal with a specific command. But before you run the command to search for permanently deleted files, you must in the configuration file scalpel.conf uncomment the line (remove the hash sign) with the extension of the desired file (All file types are commented out by default). Run the command in the terminal to open the configuration file scalpel.conf:

sudo gedit /etc/scalpel/scalpel.conf

Note. In a team gedit(Ubuntu; Linux Mint Cinnamon) change to name text editor your distribution installed by default.

For example, I chose to search for lost image files with the extension JPG and uncommented this line in the opened editor with the file scalpel.conf:

You can select any other file. Save the modified file ( Ctrl+S) and close the editor.

And now you need to run a terminal command with the tool
scalpel to find lost files:

sudo scalpel /dev/sda8 -o /home/vladimir /JPG /output/

sda8- this is a partition on the hard disk of my current system. To determine your partition and change it in the command, run the command:

The terminal should display all partitions of the hard disk. As shown in the picture, the mount point of my partition is marked with an arrow, slash or slash - sda8, which I entered into the command. You must have yours marked.

/home/vladimir- that's my name Home folder. Change vladimir on your own.

/JPG- this is the name of the folder in the command that will be created by your Home folder , where all recovered files will be saved, which you can also change to your own.

So, we execute the command and wait for the restoration to complete:

As you can see in the picture, the process of searching and restoring image files with the extension JPG on my computer will happen in two steps, as well as time, depending on the size of the specified partition (GB) and the number of images located on it.
I want to say right away that the process is not fast.

Once the recovery is complete, open Home folder with administrator rights:

sudo nautilus

Instead of nautilus indicate the name file manager your distribution (for example: Linux Mint - nemo or saja; and so on.).

Open the folder with the recovered files, select and save the files you need, and then you can delete the folder permanently, because... it will only take up precious space in the hard disk partition.

Conclusion. I would like to note that the tool scalpel finds all files with the specified extension, even those that were previously on this partition when others were once installed on it OS. This utility is also used by intelligence services in different countries to search for compromising information on the user's computer if necessary. So no matter how we delete files permanently, they still leave their mark on the hard disk.

Only physical destruction of the hard drive will save the computer user from compromising files .

Source: 10 Ways To Recover Deleted Files In Linux (blog http://www.goitexpert.com), June 21, 2007
Translation: Alexander Savvin ( [email protected])

I don't know anyone who hasn't accidentally deleted a file at least once and tried to recover it. IN Windows recovery files is a relatively easy operation. But how to do this on Linux? More precisely, if something was deleted from the command line in the Terminal screen, how can I recover this file? Some Linux distributions, such as Ubuntu, have a recycle bin, but most others do not. Deleted files are simply sent into oblivion.

Here good advice for beginners - change the rm command: alias rm="rm -i" This way, every time you delete a file, the system will ask for confirmation.

The second tip is to do backups. To copy important directories and files to another system or partition, you can use the rsync utility. With crontab you can do this daily or even hourly.

So, let's look at 10 ways to recover deleted files:

1. - automates some of the lost file recovery steps described in the Linux Ext2fs Undeletion Mini-HOWTO (translation). This utility will significantly increase the recovery efficiency. It is recommended for those who do not know how to recover files.
2. athena-delete - was written for the Athena project in response to requests from many new UNIX users who accidentally deleted files they needed.
3. unrm is a small console utility that, under certain conditions, can recover almost 99% of deleted data (similar to the undelete utility in DOS). Before using it, carefully read the FAQ file and preferably the Linux Ext2fs Undeletion Mini-HOWTO. Usage: unrm [-b (no block padding)][-e (every block)][-f fstype][-vW] device
4. - file recovery tool for Ext2/Ext3 file systems. After installation, current files and newly created files in /root and /home can be restored. It allows users to recover all deleted files, recover files owned by a specified user, dump data from file locations, and recover files of a specific type, text type, or MP3. There is also an analyzer to help users during recovery.
5. is an interactive console tool for recovering data from deleted files on the ext2 file system in Linux. Includes a library that allows you to recover deleted files by name. e2undel does not manage ext2 internal structures and does not require additional funds. It can be useful without knowing the internal structure of ext2. Usage: e2undel -d device -s path [-a][-t] -d file system, where to look for deleted files -s directory where to save recovered files -a work on all files -t try to determine the type of deleted files without names -l simply output a list of valid files to the undel log file The device must be unmounted and the path should not be specified along with the device.
6. - allows you to restore and convert file systems with minimal use of additional disk space. Unlike other recovery tools, anyfs-tools does not copy all detected files to other disks (or partitions), but simply stores information about the placement of file blocks in an external inode table. After recovery, the user can mount the damaged file system using anyfs and an external inode table and then work with all recovered files in any program.
7. rfs - console script for creating and updating a local spare system disk. The main purpose is to quickly restore a working system after a crash. In this case, "fast" means the time it takes before the machine reboots. rfs is short for "replication of filesystem". Similar to rsyncbackup, rfs is based on rsync.
8. e2retrieve is an Ext2 data recovery tool that works with truncated or partial file systems. It is very useful for retrieving data from disk corruption from LVM. It does not restore the file system, but it extracts and copies most of the data it can get from the raw Ext2 data.
9. findfile is a set of tools for recovering files on file systems with corrupted directories, allocation tables, etc. It can be useful if the partition table (or more) of the hard drive is corrupted or if the memory card from a digital camera is damaged.
10. TestDisk is a tool for checking and restoring partitions. Works with the following partitions: FAT12, FAT16, FAT32, Linux, Linux swap (versions 1 and 2), NTFS (Windows NT/W2k/2003), BeFS (BeOS), UFS (BSD), JFS, XFS and Netware.

An acquaintance came to me with the following problem: I need to recover deleted files from the camera’s flash card. I work in a store that sells and configures computers, and naturally, we only have Windows there. I had one trouble-free program in stock that helped me out, and not only, more than once - Zero Assumption Recovery. Good program in fact, but paid for Windows too. In short, she scanned a 4 gig flash drive for 2-3 hours and found something. I tried to restore, but in the end there was nothing in the restored folder. It was a shock for me! This was the first time this happened with this program. I decided to try some magic with a memory card at home, but on my native Ubuntu 11.10.

To do this, I called a program for recovery specifically from memory cards or flash drives called PhotoRec from the TestDisk package. If the program is not installed, then install:

sudo apt-get install testdisk

Now, without closing the Terminal, call the program with the command

and enter the user password

Next, we will see all sorts of connected drives on our computer. The flash drive I needed was the third one. Using the arrows up or down, right or left, we will move around the Terminal. Select the desired disk/card/flash drive, in our case UDF 2.0 Silicon-Power 8G and press Enter.

If you need to restore all files, then press Enter, and if you need to restore files of one or more types, then use the Right arrow to go to the File Opt item and then press Enter.

By default, all file types are selected for search and recovery. Use the letter S to remove all selections. Use the Up and Down arrows to find desired type files and select with the Spacebar. Press Enter.

In the lower menu, go to the Search item.

Select FAT32. Press Enter. From all options we choose Other, because Our flash drive has the FAT32 file system.

If you select the FREE item, the search will be performed in empty space and in this case only deleted files will be recovered, and if you select WHOLE, the search will be performed on the entire surface of the flash drive or disk.

Now we need to specify the directory where we will save the files we need. Select the desired folder and naturally press Enter.

Sometimes it happens that we delete, as it would seem unnecessary files(images, videos, text documents, etc.), and then suddenly we regret it, because... Among the deleted ones, the necessary ones turned out to be. It's good if we delete files in Cart, from where it is very easy to restore by pressing the key combination Ctrl+Z and then all the files that are in Cart will be restored to their previous folders or you can selectively by right-clicking on the desired file in Cart and in the context menu - Restore.

But what to do when we deleted files with the function - Delete permanently? Many people believe that the data is lost forever. But that's not true. In this case, the console utility will help us Scalpel.

Scalpel is a simple, highly effective file recovery tool.
Scalpel is a quick file recovery tool that reads the beginning and end of files of known formats from a database and tries to find them on disk. The uniqueness of this software is that it does not depend on the file system. Therefore, restoration is possible with both FATx, NTFS, ext2/3, so with "bare" (raw) sections. The tool can be used for both digital information retrieval and file recovery.

Scalpel available in the repositories of almost all distributions Linux. IN Ubuntu and derivatives you can install it from Application Center or run the command in the terminal to install:

sudo apt-get install scalpel

After installation you will not find it in the system menu Scalpel, because I mentioned above, this tool is launched from the terminal with a specific command. But before you run the command to search for permanently deleted files, you must in the configuration file scalpel.conf uncomment the line (remove the hash sign) with the extension of the desired file (All file types are commented out by default). Run the command in the terminal to open the configuration file scalpel.conf:

sudo gedit /etc/scalpel/scalpel.conf

Note. In a team gedit(Ubuntu; Linux Mint Cinnamon) change to the name of your distribution's default text editor.

For example, I chose to search for lost image files with the extension JPG and uncommented this line in the editor that opened with the file scalpel.conf:

You can select any other file. Save the modified file ( Ctrl+S) and close the editor.

And now you need to run a terminal command with the tool
scalpel to find lost files:

sudo scalpel /dev/sda8 -o /home/vladimir /JPG /output/

sda8- this is a partition on the hard disk of my current system. To determine your partition and change it in the command, run the command:

The terminal should display all partitions of the hard disk. As shown in the picture, the mount point of my partition is marked with an arrow, slash or slash - sda8, which I entered into the command. You must have yours marked.

/home/vladimir- that's my name Home folder. Change vladimir on your own.

/JPG- this is the name of the folder in the command that will be created by your Home folder, where all recovered files will be saved, which you can also change to your own.

So, we execute the command and wait for the restoration to complete:

As you can see in the picture, the process of searching and restoring image files with the extension JPG on my computer will happen in two steps, as well as time, depending on the size of the specified partition (GB) and the number of images located on it.
I want to say right away that the process is not fast.

Once the recovery is complete, open Home folder with administrator rights:

sudo nautilus

Instead of nautilus indicate the name of the file manager of your distribution (for example: Linux Mint - nemo or saja; and so on.).

Open the folder with the recovered files, select and save the files you need, and then you can delete the folder permanently, because... it will only take up precious space in the hard disk partition.

Conclusion. I would like to note that the tool scalpel finds all files with the specified extension, even those that were previously on this partition when other operating systems were once installed on it. This utility is also used by intelligence services in different countries to search for compromising information on the user's computer if necessary. So no matter how we delete files permanently, they still leave their mark on the hard disk.

Only physical destruction of the hard drive will save the computer user from compromising files .

Recovering deleted data is possible as long as you do not overwrite other information in its place. This is true for any media, so in Mint and other builds of Linux or Windows, the return of erased files is carried out according to the same scheme, only the tools differ. Below you will find instructions for working with some programs that are excellent at recovering deleted data on Linux.

Recovery via Photorec

The utility, as the name suggests, was created specifically for searching deleted photos. However, over time, the application has turned into a powerful program that finds and returns files of various formats from oblivion. The only condition for successful recovery of deleted data is that nothing should be written in its place. Therefore, immediately after files disappear, you must stop working with the disk from which they were deleted. Copying new files, changing the password - you don’t need to do any of this.

The Photorec program is distributed free of charge as part of the TestDisk package and does not require a registration key. To install it on Linux Mint or another version, open a terminal and run the command “sudo apt-get install testdisk”. To run the program, use the "sudo photorec" command.

1. After starting the application to recover files deleted from the system, enter the user password set on Linux Mint. By entering the password, you will see all the connected drives that are identified in the system. If there is no password, then you do not need to enter anything; the connected media will be displayed immediately. Using the arrow keys on your keyboard, select the partition where the erased data was stored and press Enter.
   
2. In the next window, you can immediately start a search or slightly customize the criteria by filtering out files that do not need to be restored. If you immediately start searching for data deleted from your system, you will spend a long time sorting through file “garbage.” Photorec can find something that the user has long forgotten about, so it is better to limit the program a little. Highlight File Opt (use the right arrow to move) and press Enter.
   
3. By default, all file types are selected. But in order not to overload the system with unnecessary work, uncheck all the marks by pressing the “S” key. Then use the arrows to highlight the data formats that need to be restored and press the space bar to check the box.
   
4. Then return to the previous window. Select the FAT32 format and start the search with the “Search” button.
   
5. Leave the selection on “Other”.
   
6. Select data search mode. If you select "Free", Photorec will only search for deleted files in empty space. If you select the “Whole” mode, the program will scan the entire surface, which will make it possible to recover files that were deleted from the system so long ago that the user forgot about them.
   
7. The last step is to select the directory in which the data found by the program will be saved. To start scanning, press the “C” key in the English layout.
   

The main rule of recovery is to never save files to the partition from which they were deleted. Better use removable media, when the recovery is complete, simply transfer the data back to the system. All the data that Photorec can find and recover will be located in the folder that you specified in the last step. The file names will change, so you will have to spend some time parsing the data, but this is not as critical as losing important information.