There was an idea to see what means the recovery of accidentally deleted files or recover lost data . exist at the moment. I believe that interest in the means of this kind over the years has not disappeared. After all, novice Linux users (as well as other operating systems) often find themselves in a situation where, by mistake, caused by inexperience, they delete some files and immediately realize that they didn’t delete what they wanted. Or maybe they didn’t want to delete anything at all. In Windows, in such cases, the basket saves. However, they say that some Linux distributions (for example, in Ubuntu) also have a basket. I cannot verify this statement at the moment because I do not have an Ubuntu computer at hand. But not a single Linux user alive, so I started searching the Internet for information about tools for recovering accidentally deleted files for Linux.

In addition to cases of erroneous data deletion, there may be situations when the media is corrupted, bad sectors appear on the disk, a CD is scratched, and so on. In such situations, data recovery tools are also needed.

Immediately I want to warn you that everything stated below was not personally checked by me and is based only on information published on the websites of developers or in articles with descriptions of relevant products. And, of course, the article discusses only free products. If you are interested in paid (proprietary) products, you can easily find them yourself.

So, here is a list of utilities for recovering lost data that I managed to find (data are relevant as of November 10, 2010).

  1. unrm – a small console utility that, under certain conditions, can recover almost 99% of deleted data (similar to the undelete utility in DOS). Before using it, carefully read the FAQ file and preferably Application:
    unrm [-b (no block padding)] [- e (every block)] [- f fstype] [- vW] device [block …]
  2. giis (gET iT i sAY) – file recovery tool for Ext2 / Ext3 file systems. After installation, the current files and newly created files in / root and / home can be restored. The utility allows users to recover all deleted files, recover files belonging to the specified user, dump (dump) data from the location of files and restore files of a certain type, for example, text or MP3. There is also an analyzer that helps users during recovery.
  3. ddrescue (in Ubuntu, this utility is called gddrescue) This utility copies data from a file or from a hardware device containing data to another location, while attempting to correct all existing read errors. Basic operations ddrescue performs in automatic mode, filling in a parallel protocol file. If there are two or more copies of the damaged files, ddrescue is able to completely restore the file, eliminating all errors.
    ddrescue sets the size of the I / O buffer to the size of the sector, so that it can be used for sector-wide data recovery from devices.
  4. Testdisk – is a powerful free data recovery program! It was developed primarily as a tool for recovering lost partitions and / or recovering disk boot capacity if this problem is caused by software, viruses, or human errors (such as accidentally deleting a Partition Table). It is very easy to recover the TestDisk Partition Tables. But TestDisk can also recover deleted files on FAT, NTFS and ext2 file systems; copy files from remote FAT, NTFS and ext2 / ext3 / ext4 partitions.
  5. Foremost console program that allows you to search for files on disks or their images by hex-data, characteristic headers and endings. The program scans files for matching pre-defined hex-codes (signatures) corresponding to the most common file formats. After that, it extracts them from the disk / image and adds them to the directory, together with a detailed report on what, how much and where it was recovered from. Types of files that foremost can immediately restore: jpg, gif, png, bmp, avi, exe, mpg, wav, riff, wmv, mov, pdf, ole, doc, zip, rar, htm, cpp. It is possible to add your own formats (in the configuration file /etc/foremost.conf), which the program does not know about.
  6. R-linuxis a free program to recover Ext2 / Ext3 / Ext4 FS file systems used in Linux and some Unix systems. Used in R-Linux Scn Technology and easy-to-set interface parameters of the program give the user absolute control over the data recovery process. R-Linux allows you to copy information and create an image of the whole disk or its part, and then work with the image file saved on other media, as with the original disk. R-Linux searches for files of known types using the typical characteristics of their structures, which allows the user to search and recover files from devices where the file system is unknown — HD, CD, DVD, floppy disks, USB disks, ZIP disks and flash memory devices ( Compact Flash Card, Memory Sticks). However, the program lacks the ability to recover data over the network, as well as functionality for the reconstruction of disk arrays and data recovery from them.
  7. DMDE – DM Disk Editor and Data Recovery Software. Program for editing disks and data recovery. In the free version, all functions of disk editor, partition management and file recovery are available, except for the possibility of group recovery of files and directories; The full version allows you to restore groups of files and directories while maintaining the directory structure.
  8. PhotoRec is a utility included in the TestDisk package. Designed to recover damaged files from memory cards of digital cameras (CompactFlash, Secure Digital, SmartMedia, Memory Stick, Microdrive, MMC), USB flash drives, hard drives and CD / DVD. Recovers files of most common image formats, including JPEG, audio files, including MP3, Microsoft Office document files, PDF and HTML, and archives, including ZIP files. It can work with ext2, ext3, FAT, NTFS and HFS + file systems, and is able to recover image files even when the file system is damaged or formatted.
    Can work under operating systems Linux, DOS, Windows, FreeBSD, NetBSD, OpenBSD, Mac OS X and SunOS
  9. Mondo rescue – The main purpose of this program is to create backup copies of data. It can create backup copies on magnetic tapes, CDs, on remote media via NFS or as ISO images on local disks. But in case of data corruption, the program allows you to restore them in whole or in part, even if your hard disk is not accessible by conventional means.
    Mondo runs on all major Linux distributions, supports LVM, RAID, ext2, ext3, JFS, XFS, ReiserFS, VFAT and other file systems. It can restore the disk geometry, provide data migration to RAID-arrays, check the integrity of the computer file system. In addition, it allows restructuring the disk, reduce / increase partitions, reassign devices, add hard disks.
  10. Safecopy – A data recovery tool that attempts to extract data from available, but problematic storage media (with bad sectors). The source of data can be external devices (such as CD, DVD and Blu-ray) and hard drive partitions. The program has the advantage of continuing to work even when other means of stopping it due to I / O errors. Conventional copying tools such as cat, cp, or dd do not allow you to create an image of a disk or removable media if a failure occurred while reading a sector.
  11. The Sleuth Kit (TSK) – a set of programs (fls, icat, ffind, ifind, mmls, fsstat, etc.) for conducting forensic analysis of file systems. TSK is a set of UNIX command-line tools that can analyze NTFS, FAT, FFS, EXT2FS, and EXT3FS file systems. TSK reads and processes file system structures on its own, so no support for the file system by the operating system is required.
  12. Scalpel This is a quick file recovery tool. The uniqueness of this software is that it does not depend on the file system. The program searches the database for the beginning and end of files of known formats and tries to find them on the disk. Therefore, recovery is possible with both FATx, NTFS, ext2 / 3, and from “bare” (raw) partitions.

In addition to those listed in some articles, Magicrescue and ntfsundelete from the ntfstools package are also mentioned .

This list can be very useful if you find yourself in a situation where you need to recover data from damaged media. And it is desirable to master at least some of these tools before the urgent need arises in their application. To do this, it makes sense to test them on artificial examples of deleting files, as is done in one of the notes in the list of sources.

In conclusion, a few tips may be trivial, but certainly useful, on how to try to avoid getting into an unpleasant situation when the use of the tools listed above is required. First, you can make it so that it is more difficult to accidentally delete a file or directory. To do this, make it so that instead of the rm command, the rm -icommand is invoked . You can do this with the alias command as follows:

alias rm = "rm -i"

Then, before performing the removal, you will be asked an additional question whether you really want it.

Second tip: backup your data as often as possible, every day or even every hour. If you follow this advice, in the worst case, you will lose only those results of your work that you have received in the last hour. Yes, and data recovery procedures in this case will be much easier. You can automate these procedures using cron and rsync , organizing periodic copying of important files and directories to another disk or partition. Or you can use the Mondo Rescue utility mentioned above. By the way, you will learn how to use it, which can be useful if you need to recover data in an emergency.

And third: before attempting to recover deleted files, make a copy of the partition in which these files were located, and work with it, and not with the original partition. If you go wrong again in the recovery process, you can start all over again. If you work with the original partition, you can spoil the data permanently. You can make a copy of the section using the dd command

It is also worth recalling that there are special Linux distributions running from a CD or other removable media and containing the tools of administration utilities, including data recovery tools. As an example of such distributions, the SystemRescue CD and the Trinity Rescue Kit can be mentioned.

I believe that the list above will become obsolete after a while, as happened with the list given in the article mentioned at the beginning of this note. But there will be new tools, maybe more advanced. To keep up to date, look sometimes at the site “Directory of software for Linux” , and even better – help keep this directory up to date. Then, in any abnormal or regular situation, you or another Linux user will be able to find the necessary tools and tools to solve their problems.