Note: These tools cannot recover data that has been overwritten on a hard disk.
We stored ten random pictures on each hard drive.
We then wiped the partition table from the hard drive by deleting the partitions in GParted.
Is our data lost forever?
Installing the tools
All of the tools we’re going to use are in Ubuntu’s universe repository.
Click Close, and then in the main Synaptic Package Manager window, hit the Reload button.
Foremost operates on hard drives or drive image files generated by various tools.
Finally,scalpelperforms the same functions as foremost, but is focused on enhanced performance and lower memory usage.
Scalpel may run better if you have an older machine with less RAM.
Recover hard drive partitions
If you could’t mount your hard drive, then its partition table might be corrupted.
Testdiskis the tool for the job.
Once you make your choice, you’re greeted with a list of the storage media on your machine.
TestDisk asks you opt for throw in of partition table to search for.
In most cases (ext2/3, NTFS, FAT32, etc.)
you should select Intel and press Enter.
Highlight Analyse and press enter.
In our case, our small hard drive has previously been formatted as NTFS.
Amazingly, TestDisk finds this partition, though it is unable to recover it.
It also finds the two partitions we just deleted.
We only had these two partitions, so we’ll recover them by selecting Write and pressing Enter.
Testdisk informs us that we will have to reboot.
After restarting, both of our partitions are back to their original states, pictures and all.
PhotoRec
Of the three tools we’ll show,PhotoRecis the most user-friendly, despite being a console-based utility.
You should be able to identify the right machine by its size and label.
pick the right machine, and then hit Enter.
PhotoRec asks you pick the pop in of partition to search.
In most cases (ext2/3, NTFS, FAT, etc.)
you should select Intel and press Enter.
You are given a list of the partitions on your selected hard drive.
If you want to recover all of the files on a partition, then select Search and hit enter.
PhotoRec can recover many different types of files, and deselecting each one would take a long time.
Once we’ve selected these three, we press “b” to save these selections.
Press enter to return to the list of hard drive partitions.
PhotoRec prompts for a location to store the recovered files.
If you have a different healthy hard drive, then we recommend storing the recovered files there.
Since we’re not recovering very much, we’ll store it on the Ubuntu Live CD’s desktop.
Note: Do not recover files to the hard drive you’re recovering from.
PhotoRec is able to recover the 20 pictures from the partitions on our hard drive!
Foremost is able to recover 17 of the 20 files stored on the hard drive.
Part of this may be due to the ext2 filesystem.
Foremost recommends using the –d command-line option for Linux file systems like ext2.
A final look at the pictures reveals that the pictures were recovered with no problems.
Scalpel
Scalpel is another powerful program that, like Foremost, is heavily configurable.
Unlike Foremost, Scalpel requires you to edit a configuration file before attempting any data recovery.
Any text editor will do, but we’ll use gedit to change the configuration file.
remove the “#” character at the start of those lines).
Save the file and close it.
Return to the terminal window.
These tools are lifesavers when something goes wrong with your hard drive.
If your data is on the hard drive somewhere, then one of these tools will track it down!
