Open Source Data Recovery Tools To The Rescue - InformationWeek
IoT
IoT
Cloud // Cloud Storage
News
6/10/2008
09:03 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
RELATED EVENTS
[Ransomware] Taking the Mystery out of Ransomware
Dec 07, 2016
Lost data. Systems locked down. Whole companies coming to a grinding halt. When it comes to ransom ...Read More>>

Open Source Data Recovery Tools To The Rescue

Disasters happen to the best of computers. Luckily, open source apps like SystemRescueCD, dd, Partedmagic, BackTrack, Security Tools Distribution, Helix, and TestDisk can help recover important data and bring dead systems back to life.

At some point, it hits all of us. One day you're chugging merrily along, and then you're staring at a machine that won't boot -- a machine that just happens to contain everything of importance to you. While some degree of disaster is inevitable, it's how you cope with it that counts.

While computers and file systems get more robust with each passing year, there's always going to be room for disaster recovery techniques. With open source solutions to help you recover from such messes, you're not tied to a proprietary product's costs or licensing agreements, and if you're so inclined you can rework the source code to meet your own needs.

I'm going to explore various ways you can use open source solutions to recover data, bring dead systems back to life, and save your bacon in general. Many of the solutions described here run cross-platform (Lin/Win/Mac), but some of them are *NIX-only and will be described as such.

Disaster Scenarios

No two data disasters unfold in quite the same way. To that end, you'll want to take the appropriate recovery action depending on what went wrong.

  • Simple recovery. This is the sort of recovery that you employ for files that have been freshly deleted -- typically by mistake, since accidental data deletion is the single biggest reason why files go missing. Most of the time your local "undelete" function or recycle bin / trash repository will keep you from doing anything really stupid, but sometimes that's of no use: for instance, if you forced a hard delete, or if you deleted a file from a volume that has no recovery functions enabled. Generally, you can scan the volume in question offline with a tool designed to look for and recover specific types of files (see PhotoRec later in this article), and pick up the pieces that way.




    The BackTrack live CD distribution is packed with recovery tools, including the powerful Autopsy toolset.
    (click for image gallery)

  • Complex recovery. This encompasses things like whole partitions or boot loaders going missing, along with everything on that partition. There are two basic approaches you can use here: recover what data you can from the partition, without trying to reconstruct the partition information per se; or attempt to reconstruct the partition's metadata and remount the partition normally.

    The first option is easier, although if you're dealing with an operating system partition, odds are the files you recover from there probably can't be cobbled back together into a bootable system. The second option will give you a more complete recovery, but that'll depend on how much of the actual volume data is intact. Fortunately, there are ways to recover files even from partly formatted volumes, as I'll discuss later on.

  • Removable storage or optical media. I've had more than my fair share of CDs or DVDs end up unreadable due to damage or age, but I've been lucky enough recover what I needed from them. Most tools work fine on removable drives or optical media, although in the case of CDs and DVDs, one important thing to keep in mind is the drive you're using to read them. If you have access to more than one CD/DVD drive, try creating images using different drives. You may find that one has better error correction or jitter tolerance than the others, and can recover data that other drives might skip over entirely. Also, performing the recovery from within Linux rather than Windows may yield different results as well.

  • Encrypted media recovery. This is where you say your prayers. If you're trying to recover something -- like, say, the encryption key -- from an encrypted volume, unless you used a laughably weak encryption algorithm in the first place (and why were you doing that?), you're about as likely to get that data back as a falling apple is likely to evade the law of gravity. Encrypted volumes should be treated with double the care of standard volumes: back up the volume headers (encrypted file systems typically have a provision for doing this) and keep them in a safe place, also encrypted.

In all cases, whenever you start performing recovery, make sure that any media you mount to recover from is mounted as read-only. This minimizes the chances of the distro or OS mounting and performing read/write operations on a drive that's "fragile" (i.e., holding data that needs to be recovered). Also do as little work with the original media as possible: make an image file from the media, store it on another drive you know is good, and then work from the image.

Previous
1 of 5
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends to Watch in Financial Services
IT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of November 6, 2016. We'll be talking with the InformationWeek.com editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll