Advanced File Recovery
So, a few weeks ago, someone made the mistake of upgrading a computer
to Windows Vista from Windows XP. Besides the 8-hour upgrade process
headache (what was it doing?), it also left the machine unusable.
This person ended up reinstalling Windows XP and also installing
Ubuntu. After the whole process was over, this person claimed to have
lost important files. Excellent :-)
Since the partitions were completely destroyed and the OS reinstalled,
file system level access software would not be helpful. So, I dug
deep, and came up big. foremost. This GPL software seems to have
been written by the US military, and as such, is in the Public Domain
by default. It is now GPL software, and you can use it freely.
I read up on the docs, and here's how I got almost all the files back:
* Boot Ubuntu Live CD (never recover files from the HDD-installed system)
* Add extra software repositories to apt
$ sudo sed -i "s/main restricted$/main restricted universe multiverse/g" /etc/apt/sources.list
* Install the application 'foremost'
$ sudo aptitude install foremost
* Create a recovery directory (put this on USB, instead, if you have one)
$ sudo mkdir /root/recovery
$ sudo foremost -v -i /dev/hda -o /root/recovery
* Maybe you just want all those JPG files you lost and nothing else?
$ sudo foremost -v -i /dev/hda -o /root/recovery -t jpg
Finally, copy your files somewhere safe. If you don't have enough room
in the live system, you could mount a remote partition over NFS, SSH,
Some of you may be asking yourself what to do if foremost does not support the file types you lost. Maybe you lost some precious OGG files? No worries! Why don't you give 'magicrescue' a try? magicrescue allows you to define the proper "magic bytes" that define the file type. Basically, it's what the 'file' command would check against. You can see all magic definitions in /usr/share/file/magic. You can define your own and use them as input when you run magicrescue. The possibilities are endless.
So, if you need to get your data back desperately, these are
great options for you! Keep on hacking :-)
- Bruce Nikkel's Practical Forensic Imaging (No Starch Press)
- Transitioning to Python 3
- Progress on Privacy
- Stepping into Science
- Linux Journal December 2016
- Radio Free Linux
- The Tiny Internet Project, Part II
- CORSAIR's Carbide Air 740
- FutureVault Inc.'s FutureVault
- A Better Raspberry Pi Streaming Solution