We are still actively working on the spam issue.

Difference between revisions of "Data recovery"

From InstallGentoo Wiki
Jump to: navigation, search
(Added in headings, links to the tools mentioned in the drive recovery process, and a short explanation taken from the TestDisk wiki (sourced appropriately).)
(Changed format and added information to comply with the Wiki editing guide (http://wiki.installgentoo.com/index.php?title=/g/wiki:Guide_to_editing_this_wiki))
Line 1: Line 1:
 
{{Cleanup}}
 
{{Cleanup}}
  
 +
== What is Data Recovery? ==
 +
 +
Data recovery, is the method or process of recovering your data. It is usually done after drive failure, accidental deletion of data, or by the police when recovering suspect's data from a computer.
  
 
== Data Recovery Tools ==
 
== Data Recovery Tools ==
Line 10: Line 13:
 
Note: TestDisk and PhotoRec come as a package, TestDisk is used to "help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table)."[http://www.cgsecurity.org/wiki/TestDisk] Whereas PhotoRec is for recovering data, therefore depending on your needs either one may be appropriate.
 
Note: TestDisk and PhotoRec come as a package, TestDisk is used to "help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table)."[http://www.cgsecurity.org/wiki/TestDisk] Whereas PhotoRec is for recovering data, therefore depending on your needs either one may be appropriate.
  
 +
 +
== First steps in recovering data ==
 +
 +
*<strong>DO NOT WRITE TO THE DRIVE</strong>
 +
** Doing so may overwrite the information that you wish to recover
 +
 +
*Follow the process detailed below
 +
*Next time, <strong>keep an up-to-date backup</strong>
  
 
== An example of a drive recovery process==
 
== An example of a drive recovery process==

Revision as of 06:00, 23 February 2014

Cleanup.png
Cleanup.png
CLEANUP CANDIDATE
Relevant discussion may be found on the talk page. Reason: No reason specified.


What is Data Recovery?

Data recovery, is the method or process of recovering your data. It is usually done after drive failure, accidental deletion of data, or by the police when recovering suspect's data from a computer.

Data Recovery Tools

Note: TestDisk and PhotoRec come as a package, TestDisk is used to "help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error (such as accidentally deleting a Partition Table)."[1] Whereas PhotoRec is for recovering data, therefore depending on your needs either one may be appropriate.


First steps in recovering data

  • DO NOT WRITE TO THE DRIVE
    • Doing so may overwrite the information that you wish to recover
  • Follow the process detailed below
  • Next time, keep an up-to-date backup

An example of a drive recovery process

Here's what you have to do to save your data, if the hard drive still mounts.

You can tell that your hard drive is failing if it causes your computer to hang in the BIOS when connected, if it has a "Current Pending Sector Count" > 0 in the SMART info, or if it's making unusual noises.

First, get another hard drive large enough to image the failing one onto.

Connect the failing hard drive to an internal SATA port on your computer, if it's in a USB enclosure open it up and remove the drive.

Next, boot from a GNU/Linux LiveCD and use an imaging program that doesn't retry I/O errors endlessly. Mount the failing drive Read-Only first. Use dd_rescue or an equivalent so that it doesn't get stuck forever rereading one sector when it encounters read errors.

Finally, if you are able to mount the disk image, do that. If not able to mount the copy, try Testdisk and Photorec or Recuva to recover data from the image. Recover the saved data to yet another separate partition.

If you had to use PhotoRec, you will probably want to disable recovery of plain text files unless there's something in that format you want to save since it produces a massive amount of tiny text files from most hard drives. Stick to photos and Office documents for most people. Fragmented files will probably be unrecoverable.

External Links

Forensics Wiki