There are a lot of howtos and tutorials for using data recovery tools in Linux, but far less on how to choose a recovery tool or approach in the first place. Here’s an overview with suggestions for which route to go or tool to use:
| Cause | Outlook | Tools |
|---|---|---|
| Forgotten login password | Fantastic | Any livecd |
| This barely qualifies as data recovery, but is included for completeness. If you forget the login password, you can just boot a livecd and mount the drive to access the files. You can also chroot into it and reset the password. Google “linux forgot password”. | ||
| Accidentally deleting files in use | Excellent | lsof, cp |
| When accidentally deleting a file that is still in use by some process — like an active log file or the source of a video you’re encoding — make sure the process doesn’t exit (sigstop if necessary) and copy the file from the /proc file handle. Google “lsof recover deleted files” | ||
| Accidentally deleting other files | Fair for harddisks, bad for SSDs | testdisk, ext3grep, extundelete |
| When deleting a file that’s not currently being held open, stop as much disk activity as you can to prevent the data from being overwritten. If you’re using an SSD, the data was probably irrevocably cleared within seconds, so bad luck there. Proceed with an fs specific undeletion tool: Testdisk can undelete NTFS, VFAT and ext2, extundelete/ext3grep can help with ext3 and ext4. Google “YourFS undeletion”. If you can’t find an undeletion tool for your file systems, or if it fails, try PhotoRec. | ||
| Trashing the MBR or deleting partitions | Excellent | gpart (note: not gparted), testdisk |
| If you delete a partition with fdisk or recover the MBR from a backup while forgetting that it also contains a partition table, gpart or testdisk will usually easily recover them. If you overwrite any more than the first couple of kilobytes though, it’s a different ballgame. Just don’t confuse gpart (guess partitions) with gparted (gtk/graphical partition editor). Google “recover partition table”. | ||
| Reformatting a file system | Depends on fs | e2fsck, photorec, testdisk |
| If you format the wrong partition, recovery depends on the old and new file system. Try finding unformat/recovery tools for your old fs. Accidentally formatting a ext3 fs to ntfs (like Windows helpfully suggests when it detects a Linux fs) can often be almost completely reverted by running fsck with an alternate superblock. Google “ext3 alternate superblock recovery” or somesuch. Reformatting ext2/3/4 with ext2/3/4 will tend to overwrite the superblocks, making this harder. Consider PhotoRec. | ||
| Repartition and reinstall | Depends on progress | |
| If you ran a distro installer and accidentally repartitioned and reformatted a disk, try treating it as a case of deleted partitions plus reformatted partitions as described above. Chances of recovery are smaller the more files the installer copied to the partitions. If all else fails, PhotoRec. | ||
| Bad sectors and drive errors | Ok, depending on extent | ddrescue |
| If the drive has errors, use ddrescue to get as much of the data as possible onto another drive, then treat it as a corrupted file system. Try the fs’ fsck tool, or if the drive is highly corrupted, PhotoRec. | ||
| Lost encryption key | Very bad | bash, cryptsetup |
| I don’t know of any tools made for attempting to crack a LUKS password, though you can generate permutations and script a simple cracker if you have limited number of permutations (“it was Swordfish with some l33t, and a few numbers at the end”). If you have no idea, or if your encryption software uses TPM (rare for Linux), you’re screwed. | ||
| Reformatted or partially overwritten LUKS partition | Horrible | |
| LUKS uses your passphrase to encrypt a master key, and stores this info at the start of the partition. If this gets overwritten, you’re screwed even if you know the passphrase. | ||
| Other kinds of corruptions or unknown FS | Indeterminable | PhotoRec, strings, grep |
| PhotoRec searches by file signature, and can therefore recover files from a boatload of FS and scenarios, though you’ll often lose filenames and hierarchies. If you have important ASCII data, strings can dump ASCII text regardless of FS, and you can grep that as a last resort. | ||
If you have other suggestions for scenarios, tools or approaches, leave a commment. Otherwise, I’ll wish you a speedy recovery!
Great article!
A note on the case of partially overwriting a LUKS partition: One should always keep a backup of the LUKS header (on some other volume/partition) exactly for this reason. It’s about a half a meg file that contains the relevant metadata for the partition, including the master key, which is kept encrypted with (the key derived from) your passphrase; so having it lying around doesn’t compromise your security anymore than the existence of the actual partition, and it can make a world of difference when it comes to salvaging anything at all from such a damaged partition.