Data recovery with the TestDisk/PhotoRec duo

Cool Heads Can Save Data

It is not a good idea to try to perform data recovery without taking time to consider some helpful rules. The first thing to find out when you suspect that data has been lost on a hard drive, memory card, or USB stick is to make sure that the storage device is no longer written to. Otherwise, data can become irretrievably deleted.

Both tools have to be operated as the root user. If at all possible, you should not work with the original data. Instead, you can use the dcfldd [6], program, which is based on dd in the source text to copy the data. Among other things, it creates copies of files, partitions, and entire hard drives. It also creates MD5 sums and offers verification down to the bit for originals and copies. Unlike dd, it has a progress indicator so that during the copying of entire partitions or hard drives, the remaining copy time is displayed. Dcfldd can also automatically distribute the data across several files.

Preparatory Work

Just as you want to avoid working with the original data, you also don't want to work directly in the affected filesystem. Recovered data should never be written to the same partition. For this situation, Linux has an ideal solution. The system makes it possible to work from a current live CD or from specialty tool collections such as Parted Magic, SystemRescueCD or Ultimate Boot CD. Almost all of the distributions come with the TestDisk/PhotoRec duo. Adrenalin levels can rise when the user suspects a loss of data.

Operating the software can become difficult under such circumstances. Thus, it is a good idea to perform at least one dry run to have a basic idea of how the software works. If these basic conditions are met, you can start the tool of your choice from a terminal in a live medium, using:

dd if=/dev/zero of=/dev/sdb bs=512 count=1

For testing, I intentionally clobbered the partition table of an external FAT formatted 3TB mechanical hard drive. To carry out the test, I used TestDisk to reconstruct the partition table. I also deleted about 600GB of mixed data, which I tried to recover with PhotoRec. Test hardware included a current notebook model with a Haswell CPU and 8GB RAM.