Data recovery could become very costly. Sometimes you’d pay anything to get your data back; whether it’s your family photos or your business’s database of inventory or customer contacts. Well luckily in Linux there are many data recovery tools available completely free! You might be thinking, “Oh yea, another free data recovery app that gets me a few MB of data free then have to pay for the rest”. Nope, you can recover as much data as you have storage for! If you have a drive with 2TB free space, well you can recover up to 2TB of data!
Some of the data recovery tools available to install on Linux that I’ve used is TestDisk, PhotoRec, and ddrescue. I’m sure there are more, but these are the ones I’ve used and have been successful using.
I usually start with dd, creating an image of the device if it was corrupt, bad blocks, failing hardware, etc. This way I can work from the image and not put anymore wear on the device.
Next I’ll use both TestDisk and PhotoRec to recover any data from the device (if healthy) or the image. I normally do use both in case they recover different data or more data. Usually they are the same. There have been a few instances where TestDisk had a few more files, there have also been instances where PhotoRec will have a few more files. Sometimes there have even been times where they both data recovery apps recovered more files than the other; just different ones.
Example: TestDisk recovered 26 files, 24 of them were the same files PhotoRec recovered, having 2 files PhotoRec didn’t have, but PhotoRec also recovered 26 files, 24 being same that TestDisk recovered, while the other 2 were 2 different ones that weren’t recovered by TestDisk.
That is why I run them both, just in case, but again, they are almost always the same exact files recovered.
Installing data recovery software for Linux
Installing these Linux data recovery apps is pretty simple. If you’re using Debian or Ubuntu you can just open a terminal and install using the following commands:
sudo apt update && sudo apt install testdisk gddrescue
If you’re running Arch Linux:
sudo pacman -S testdisk ddrescue
If you’re running Fedora Linux:
sudo dnf install testdisk ddrescue
NOTE: Most Linux distributions bundle TestDisk and PhotoRec under the same name: testdisk
How to use Linux Data Recovery Apps
Now that you’ve installed Linux data recover software, you can recover your photos or other files that have become corrupt or you accidentally deleted.
If you have a damaged drive you can use ddrescue to create an image of it. Make sure you have the correct drive as your source, which you can find by looking at dmesg if you just connected it, or mount, or lsblk.
lsblk -o NAME,SIZE,MODEL,SERIAL,FSTYPE,MOUNTPOINTS
sudo ddrescue -f -n /dev/sdX /home/username/recovery/drive.img /home/username/recovery/drive.log
/dev/sdX = damaged source drivedrive.img = destination imagedrive.log = mapfile that lets you resume-n = first pass, don’t spend time retrying bad sectors
After the initial pass is done you can use the following to try to reread the bad sectors.
sudo ddrescue -d -r3 /dev/sdX /mnt/recovery/drive.img /mnt/recovery/drive.log
-d = direct disk access-r3 = retry failed areas 3 times
Now you can use testdisk on the image:
sudo testdisk /home/username/recovery/drive.img
sudo photorec /home/username/recovery/drive.img
The above 2 commands will write the files recovered in the current working directory, make sure you’re not on the drive being recovered.
You can also recover the drive directly if you don’t need to create an image first.
sudo testdisk /dev/sdX
sudo photorec /dev/sdX
I’d use the above 2 commands if I accidentally deleted my files, or re-partitioned, etc. If the drive was actually damaged in some way, I’d create an image first.
I hope this Linux tutorial has helped you recover your important lost files, photos, etc. I’ve had to do this with a few CF cards, SD cards of mine that were accidentally deleted. i’ve also done this for some friends that have done the same, or had a failing hard drive.
NOTE: These data recover programs can not recover data, files, photos, etc. that have already been over written. If you delete files, your operating system didn’t really delete the data on your hard drive, it just tells you it’s no longer there so other data can be written in that same spot later. This is how data can be recovered. With a failing drive, if that physical spot on the hard drive is dead, well, you’re not recovering the whole file. I have had a few friends give me failing SD cards or USB flash drives and when I recover the photos, some would have lines through them, or chunks missing or wrong color due to data missing.