Open Source Data Recovery Tools To The Rescue - InformationWeek
Cloud // Cloud Storage
09:03 PM
Connect Directly

Open Source Data Recovery Tools To The Rescue

Disasters happen to the best of computers. Luckily, open source apps like SystemRescueCD, dd, Partedmagic, BackTrack, Security Tools Distribution, Helix, and TestDisk can help recover important data and bring dead systems back to life.

File Carving

I mentioned before that it is possible to recover files from file systems where the partition information has been damaged or where the volume itself has been partially reformatted. This can be done through a technique called "data carving" or "file carving," where a program hunts for specific kinds of files by looking for patterns common to certain file types. One of the best things about this technique is that it's almost entirely automatic: all you have to do is point it at a partition -- or the place where a partition was -- select a place to restore the files to, and let the program do the heavy lifting.

The authors of TestDisk have created an excellent file-carving tool called PhotoRec, which recovers many common file formats from pretty much any type of media.

This is about as essential a standalone file-recovery tool as you're going to get. I tried it out on a camera card I'd written off as wiped out after a recent trip, and managed to recover literally everything from the card -- both pictures and video. It wasn't able to recover some of the actual filenames, but the files themselves were all perfectly readable. Like TestDisk, by default it will attempt to copy files somewhere other than the media being rescued to avoid further damage.

The default settings for PhotoRec generally work fine, but if you need finer-grained control there are a few options you can set. "Paranoid mode," normally disabled, recovers everything including partially corrupted files; if you turn this on, you'll get more data recovered, but the recovery process may take much longer. (Brew some coffee.) In the same vein, "Keep corrupted files" will recover files that are not fully readable in the hopes that the user can salvage something further from them, perhaps with a hex editor or another tool.

These files recovered with PhotoRec have new names, but the metadata tells you they are audio files.
(click for image gallery)

Note that most of the time, files recovered with PhotoRec will not have their original names, but internal metadata (e.g., MP3 tags or EXIF data) will still be available. Also note that if you're looking for one very specific kind of file in a relatively small file system, you can use the program's internal options to narrow down the search and not waste time recovering everything under the sun.

TestDisk and PhotoRec are also both included by default with the Partedmagic rescue disc, so that's one of the easiest ways to get your hands on them and put them to work -- but you can also download them as standalone programs and use them that way. Both can also be integrated into the BartPE rescue disc if you use it; my trick has been to include them with my PortableApps installation. It's also possible to mount them on a removable drive, boot a Vista installation DVD (if you have one), go to the System Recovery command line, and then run the programs from there.

4 of 5
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of the Cloud Report
As the use of public cloud becomes a given, IT leaders must navigate the transition and advocate for management tools or architectures that allow them to realize the benefits they seek. Download this report to explore the issues and how to best leverage the cloud moving forward.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on for the week of November 6, 2016. We'll be talking with the editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll