How I Do Data Recovery
This week Amy plugged in her flash drive to discover that there were no files on it. Weeks before there had been dozens of large cuts of footage that she needed to edit down for work. Hours of recordings were seemingly gone. And the most annoying part was the drive had worked perfectly on several other occasions. Just not now that the footage was actually needed of course. Initially it looked like everything had been wiped clean, however both Amy's Mac and her PC thought the drive was half full. It's overall capacity was 64GB but it showed only about 36GB free. So there still had to be data on there if we could find the right tool to salvage it.
Luckily this wasn't the first time I had to recover accidentally (or
magically) deleted files. I had previously done so with some success at
my tech support job, for some college friends, and for my in-laws'
retired laptops. So I had a pretty clear idea of what to expect. The
only trick was finding a tool that knew what files it was looking for.
The camera that took the video clips was a Sony and apparently they
record into m2ts files, which are kind of a unique format
in that they only show up on Blu-Ray discs and Sony camcorders. Enter my
favorite two tools for dealing with potentially-destroyed data:
ddrescue and photorec.
DDRescue
ddrescue is a godsend of a tool. If you've ever used
dd before, forget about it. Use ddrescue. You
might as well alias dd=ddrescue because it's that great. By
default it has a plethora of additional options, displays the progress
as it works, recovers and retries in the event of I/O errors, and does
everything that good old dd can do. It's particularly good
at protecting partitions or disks that have been corrupted or damaged by
rescuing undamaged portions first. Oh, and have you ever had to cancel a
dd operation? Did I mention that ddrescue can
pause and resume operations? It's that good.
PhotoRec
photorec is probably the best missing file recovery tool
I've ever used in my entire life. And I've used quite a few. I've never
had as good results as I've had with photorec with other
tools like Recuva et. al. And photorec isn't just for
photos, it can recover documents (a la Office suite), music, images,
config files, and videos (including the very odd
m2ts format!). The other nice thing is
photorec will work on just about any source. It's also free
software which makes me wonder why there are like $50 recovery tools for
Windows that look super sketchy.
In Practice
So here's what I did to get Amy's files back. Luckily she didn't write
anything out to the drive afterward so the chances (I thought) were
pretty good that I would get something back. The first thing I
always do is make a full image of whatever media I'm trying to recover
from. I do this for a couple of reasons. First of all it's a backup. If
something goes wrong during recovery I don't have to worry about the
original, fragile media being damaged or wiped. Furthermore, I can work
with multiple copies at a time. If it's a large image that means
multiple tools or even multiple PCs can work on it at once. It's also
just plain faster working off a disk image than a measly flash drive. So
I used ddrescue to make an image of Amy's drive.
$ sudo ddrescue /dev/sdb1 amy-lexar.dd
GNU ddrescue 1.24
Press Ctrl-C to interrupt
ipos: 54198 kB, non-trimmed: 0 B, current rate: 7864 kB/s
opos: 54198 kB, non-scraped: 0 B, average rate: 18066 kB/s
non-tried: 63967 MB, bad-sector: 0 B, error rate: 0 B/s
rescued: 54198 kB, bad areas: 0, run time: 2s
pct rescued: 0.08%, read errors: 0, remaining time: 59m
time since last successful read: n/a
Copying non-tried blocks... Pass 1 (forwards)
The result was a very large partition image that I could fearlessly play around with.
$ ll amy-lexar.dd
-rw-r--r-- 1 root root 60G Sep 24 02:45 amy-lexar.dd
Then I could run photorec on the image. This brings up a
TUI with all of the listed media that I can try and recover from.
$ sudo photorec amy-lexar.dd
PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org
PhotoRec is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
>Disk amy-lexar.dd - 64 GB / 59 GiB (RO)
>[Proceed ] [ Quit ]
Note:
Disk capacity must be correctly detected for a successful recovery.
If a disk listed above has incorrect size, check HD jumper settings, BIOS
detection, and install the latest OS patches and disk drivers.
After hitting proceed photorec asks if you want to scan
just a particular partition or the whole disk (if you made a whole disk
image). I can usually get away with just selecting the partition I know
the files are on and starting a search.
PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org
Disk amy-lexar.dd - 64 GB / 59 GiB (RO)
Partition Start End Size in sectors
Unknown 0 0 1 7783 139 4 125042656 [Whole disk]
> P FAT32 0 0 1 7783 139 4 125042656 [NO NAME]
>[ Search ] [Options ] [File Opt] [ Quit ]
Start file recovery
Then photorec asks a couple of questions about the
formatting of the media. It can usually figure them out all by itself so
I just use the default options unless it's way out in left field.
PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org
P FAT32 0 0 1 7783 139 4 125042656 [NO NAME]
To recover lost files, PhotoRec need to know the filesystem type where the
file were stored:
[ ext2/ext3 ] ext2/ext3/ext4 filesystem
>[ Other ] FAT/NTFS/HFS+/ReiserFS/...
Now this menu is where I don't just go with the default path.
photorec will offer to search just unallocated space or the
entire partition. I always go for the whole partition here; sometimes
I'll get back files that I didn't really care about but more often than
not I end up rescuing more data this way. In this scenario searching
just unallocated space found no files at all. So I told
photorec to search everything.
PhotoRec 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org
P FAT32 0 0 1 7783 139 4 125042656 [NO NAME]
Please choose if all space need to be analysed:
[ Free ] Scan for file from FAT32 unallocated space only
>[ Whole ] Extract files from whole partition
Now it'll ask where you want to save any files it finds. I threw them all into a directory under home that I could zip up and send to Amy's Mac later.
PhotoRec 7.0, Data Recovery Utility, April 2015
Please select a destination to save the recovered files.
Do not choose to write the files to the same partition they were stored on.
Keys: Arrow keys to select another directory
C when the destination is correct
Q to quit
Directory /home/adam
drwx------ 1000 1000 4096 28-Sep-2019 12:10 .
drwxr-xr-x 0 0 4096 26-Jan-2019 15:32 ..
>drwxr-xr-x 1000 1000 4096 28-Sep-2019 12:10 amy-lexar-recovery
And then just press C. photrec will start
copying all of the files it finds into that directory. It reports what
kinds of files it found and how many it was able to locate. I was able
to recover all of Amy's lost footage this way, past, along with some
straggler files that had been on the drive at one point. This has worked
for me many times in the past, both on newer devices like flash drives
and on super old, sketchy IDE hard drives. I probably won't ever pay for
data recovery unless a drive has been physically damaged in some way. In
other words, this software works great for me and I don't foresee the
need for anything else out there. It's simple to use and is typically
pretty reliable.