Immediately cease all write operations to the storage device from which data was lost. Each new byte of data written reduces the chances of successful recovery.
For recovery operations, prefer using a live system booted from a USB drive to avoid the main OS writing cache or temporary files to the disk. Prepare an external storage device with sufficient free space to save the recovered files.
TestDisk and PhotoRec: A Comprehensive Solution
Install the packages on Debian/Ubuntu-based systems with the command:
sudo apt-get update && sudo apt-get install testdisk
PhotoRec operates independently of the file system, analyzing the drive at the raw data level to identify files by their header signatures. The tool supports over 300 file formats.
File Recovery with PhotoRec
Launch the utility with superuser privileges:
sudo photorec
The interface provides a step-by-step guide:
- Selection of the target storage device (/dev/sda, /dev/sdb)
- Specification of the partition scheme (Intel, Sun, Mac)
- Choice of the file system type to scan
- Definition of the directory to save the results
The process can take a considerable amount of time depending on the drive's capacity and speed.
Partition Table Recovery with TestDisk
To repair a partition table or restore boot sectors, use:
sudo testdisk
The workflow includes:
- Analysis of the current partition structure
- Search for lost partitions
- Creation of a new partition table
- Writing changes to the MBR or GPT
Specialized Tools for ext2/ext3/ext4
For the ext family of file systems, the extundelete utility is used. Installation and usage:sudo apt-get install extundelete sudo extundelete /dev/sdX --restore-all --output-dir /path/to/restoreKey options:
- --restore-all: Attempts to restore all contents
- --restore-file: Restores a specific file by its path
- --restore-inode: Restores a file by its inode number
Foremost: File Signature-Based Recovery
This tool performs low-level scanning with predefined file format templates. The default configuration is located in /etc/foremost.conf.sudo foremost -t jpg,pdf,docx -i /dev/sdX -o /path/to/restoreThe -t parameter allows explicit specification of the file types to search for.
Additional Techniques and Tools
Scalpel offers an advanced scanning algorithm with flexible configuration of templates via its configuration file. To create a disk image for analysis, using ddrescue is recommended:sudo ddrescue /dev/sdX /path/to/image.dd /path/to/logfile.logThis allows all recovery operations to be performed on the image, preventing further damage to the original media.