Data Recovery on Linux using TestDisk

Recover Files using TestDisk

Mount the partition with the lost files read only:

sudo mount -o remount,ro /dev/sdX

Install the requirements, the TestDisk suite:

sudo apt-get install testdisk

Start analysing:

sudo testdisk /dev/sdX
  1. Select your disk and enter Proceed.
  2. TeskDisk tries to find the correct partition type. If you are sure, the default selection is wrong, change it.
  3. Select Advanced Filesystem Utils.
  4. Select a desired partition and choose Undelete.
  5. Select desired file to recover and hit c key to copy into our current directory so answer Y. Once the copy is done quit from tesdisk utility with q key.

PhotoRec (part of TestDisk)

Dedicated PhotoRec Documentation: http://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step

Create a dd image of the partition to analyse and start recovering using:

sudo photorec dd_partition_image.img

Resources

Comments