How I Do Data Recovery

This week Amy plugged in her flash drive to discover that there were no files on it. Weeks before there had been dozens of large cuts of footage that she needed to edit down for work. Hours of recordings were seemingly gone. And the most annoying part was the drive had worked perfectly on several other occasions. Just not now that the footage was actually needed of course. Initially it looked like everything had been wiped clean, however both Amy's Mac and her PC thought the drive was half full. It's overall capacity was 64GB but it showed only about 36GB free. So there still had to be data on there if we could find the right tool to salvage it.

Luckily this wasn't the first time I had to recover accidentally (or magically) deleted files. I had previously done so with some success at my tech support job, for some college friends, and for my in-laws' retired laptops. So I had a pretty clear idea of what to expect. The only trick was finding a tool that knew what files it was looking for. The camera that took the video clips was a Sony and apparently they record into m2ts files, which are kind of a unique format in that they only show up on Blu-Ray discs and Sony camcorders. Enter my favorite two tools for dealing with potentially-destroyed data: ddrescue and photorec.

DDRescue

ddrescue is a godsend of a tool. If you've ever used dd before, forget about it. Use ddrescue. You might as well alias dd=ddrescue because it's that great. By default it has a plethora of additional options, displays the progress as it works, recovers and retries in the event of I/O errors, and does everything that good old dd can do. It's particularly good at protecting partitions or disks that have been corrupted or damaged by rescuing undamaged portions first. Oh, and have you ever had to cancel a dd operation? Did I mention that ddrescue can pause and resume operations? It's that good.

PhotoRec

photorec is probably the best missing file recovery tool I've ever used in my entire life. And I've used quite a few. I've never had as good results as I've had with photorec with other tools like Recuva et. al. And photorec isn't just for photos, it can recover documents (a la Office suite), music, images, config files, and videos (including the very odd m2ts format!). The other nice thing is photorec will work on just about any source. It's also free software which makes me wonder why there are like $50 recovery tools for Windows that look super sketchy.

In Practice

So here's what I did to get Amy's files back. Luckily she didn't write anything out to the drive afterward so the chances (I thought) were pretty good that I would get something back. The first thing I always do is make a full image of whatever media I'm trying to recover from. I do this for a couple of reasons. First of all it's a backup. If something goes wrong during recovery I don't have to worry about the original, fragile media being damaged or wiped. Furthermore, I can work with multiple copies at a time. If it's a large image that means multiple tools or even multiple PCs can work on it at once. It's also just plain faster working off a disk image than a measly flash drive. So I used ddrescue to make an image of Amy's drive.


$ sudo ddrescue /dev/sdb1 amy-lexar.dd
GNU ddrescue 1.24
Press Ctrl-C to interrupt
     ipos:   54198 kB, non-trimmed:        0 B,  current rate:   7864 kB/s
     opos:   54198 kB, non-scraped:        0 B,  average rate:  18066 kB/s
non-tried:   63967 MB,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:   54198 kB,   bad areas:        0,        run time:          2s
pct rescued:    0.08%, read errors:        0,  remaining time:         59m
                              time since last successful read:         n/a
Copying non-tried blocks... Pass 1 (forwards)
	  

The result was a very large partition image that I could fearlessly play around with.

		
$ ll amy-lexar.dd
-rw-r--r-- 1 root root 60G Sep 24 02:45 amy-lexar.dd
        
	  

Then I could run photorec on the image. This brings up a TUI with all of the listed media that I can try and recover from.


$ sudo photorec amy-lexar.dd

PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org

  PhotoRec is free software, and
comes with ABSOLUTELY NO WARRANTY.

Select a media (use Arrow keys, then press Enter):
>Disk amy-lexar.dd - 64 GB / 59 GiB (RO)

>[Proceed ]  [  Quit  ]

Note:
Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.
	  

After hitting proceed photorec asks if you want to scan just a particular partition or the whole disk (if you made a whole disk image). I can usually get away with just selecting the partition I know the files are on and starting a search.


PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org

Disk amy-lexar.dd - 64 GB / 59 GiB (RO)

     Partition                  Start        End    Size in sectors
      Unknown                  0   0  1  7783 139  4  125042656 [Whole disk]
>   P FAT32                    0   0  1  7783 139  4  125042656 [NO NAME]

>[ Search ]  [Options ]  [File Opt]  [  Quit  ]
                              Start file recovery
	  

Then photorec asks a couple of questions about the formatting of the media. It can usually figure them out all by itself so I just use the default options unless it's way out in left field.


PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org

   P FAT32                    0   0  1  7783 139  4  125042656 [NO NAME]

To recover lost files, PhotoRec need to know the filesystem type where the
file were stored:
 [ ext2/ext3 ] ext2/ext3/ext4 filesystem
>[ Other     ] FAT/NTFS/HFS+/ReiserFS/...
	  

Now this menu is where I don't just go with the default path. photorec will offer to search just unallocated space or the entire partition. I always go for the whole partition here; sometimes I'll get back files that I didn't really care about but more often than not I end up rescuing more data this way. In this scenario searching just unallocated space found no files at all. So I told photorec to search everything.


PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org

   P FAT32                    0   0  1  7783 139  4  125042656 [NO NAME]


Please choose if all space need to be analysed:
 [   Free    ] Scan for file from FAT32 unallocated space only
>[   Whole   ] Extract files from whole partition
	  

Now it'll ask where you want to save any files it finds. I threw them all into a directory under home that I could zip up and send to Amy's Mac later.


PhotoRec 7.0, Data Recovery Utility, April 2015

Please select a destination to save the recovered files.
Do not choose to write the files to the same partition they were stored on.
Keys: Arrow keys to select another directory
      C when the destination is correct
      Q to quit
Directory /home/adam
 drwx------  1000  1000      4096 28-Sep-2019 12:10 .
 drwxr-xr-x     0     0      4096 26-Jan-2019 15:32 ..
>drwxr-xr-x  1000  1000      4096 28-Sep-2019 12:10 amy-lexar-recovery
	  

And then just press C. photrec will start copying all of the files it finds into that directory. It reports what kinds of files it found and how many it was able to locate. I was able to recover all of Amy's lost footage this way, past, along with some straggler files that had been on the drive at one point. This has worked for me many times in the past, both on newer devices like flash drives and on super old, sketchy IDE hard drives. I probably won't ever pay for data recovery unless a drive has been physically damaged in some way. In other words, this software works great for me and I don't foresee the need for anything else out there. It's simple to use and is typically pretty reliable.