From e6eae91b853614b5a291dc22ca3f8a42cad392f8 Mon Sep 17 00:00:00 2001 From: Adam Carpenter Date: Wed, 25 Sep 2019 21:33:58 -0400 Subject: Added file recovery --- posts/my-preferred-method-for-data-recovery.md | 48 ++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 posts/my-preferred-method-for-data-recovery.md diff --git a/posts/my-preferred-method-for-data-recovery.md b/posts/my-preferred-method-for-data-recovery.md new file mode 100644 index 0000000..56f513e --- /dev/null +++ b/posts/my-preferred-method-for-data-recovery.md @@ -0,0 +1,48 @@ +--- +permalink: "/posts/{{categories}}/{{slug}}" +title: My Preferred Method for Data Recovery +categories: ["life"] +tags: + - data + - file + - photo + - recovery + - linux + - photorec +excerpt_separator: "\n\n\n" +layout: post.liquid +is_draft: true +--- + +This week Amy plugged in her flash drive to discover that there were no files +on it. Weeks before there had been dozens of large cuts of footage that she +needed to edit down for work. Hours of recordings were seemingly gone. And the +most annoying part was the drive had worked perfectly on several other +occasions. Just not now that the footage was actually needed of course. +Initially it looked like everything had been wiped clean, however both Amy's +Mac and her PC thought the drive was half full. It's overall capacity was 64GB +but it showed only about 36GB free. So there still had to be data on there if +we could find the right tool to salvage it. + +Luckily this wasn't the first time I had to recover accidentally (or magically) +deleted files. I had previously done so with some success at my tech support +job, for some college friends, and for my in-laws' retired laptops. So I had a +pretty clear idea of what to expect. The only trick was finding a tool that +knew what files it was looking for. The camera that took the video clips was a +Sony and apparently they record into `m2ts` files, which are kind of a unique +format in that they only show up on Blu-Ray discs and Sony camcorders. Enter my +favorite two tools for dealing with potentially-destroyed data: `ddrescue` and +`photorec`. + +`ddrescue` is a godsend of a tool. If you've ever used `dd` before, forget +about it. Use `ddrescue`. You might as well `alias dd=ddrescue` because it's +that great. By default it has a plethora of additional options, displays the +progress as it works, recovers and retries in the event of I/O errors, and does +everything that good old `dd` can do. It's particularly good at protecting +partitions or disks that have been corrupted or damaged by rescuing undamaged +portions first. Oh, and have you ever had to cancel a `dd` operation? Did I +mention that `ddrescue` can pause and resume copies? It's that good. + +`photorec` is probably the best missing file recovery tool I've ever used in my entire life. And I've used quite a few. I've never had as good results as I've had with `photorec` with other tools like Recuva et. al. And `photorec` isn't just for photos, it can recover documents (a la Office suite), music, images, config files, and videos (including the very odd `m2ts` format!). The other nice thing is photorec will work on just about any + +- plus scan whole partition -- cgit v1.2.3