---
permalink: "/posts/{{categories}}/{{slug}}"
title: My Preferred Method for Data Recovery
categories: ["life"]
tags: 
    - data
    - file
    - photo
    - recovery
    - linux
    - photorec
excerpt_separator: "\n\n\n"
layout: post.liquid
is_draft: true
---

This week Amy plugged in her flash drive to discover that there were no files
on it. Weeks before there had been dozens of large cuts of footage that she
needed to edit down for work. Hours of recordings were seemingly gone. And the
most annoying part was the drive had worked perfectly on several other
occasions. Just not now that the footage was actually needed of course.
Initially it looked like everything had been wiped clean, however both Amy's
Mac and her PC thought the drive was half full. It's overall capacity was 64GB
but it showed only about 36GB free. So there still had to be data on there if
we could find the right tool to salvage it. 

Luckily this wasn't the first time I had to recover accidentally (or magically)
deleted files. I had previously done so with some success at my tech support
job, for some college friends, and for my in-laws' retired laptops. So I had a
pretty clear idea of what to expect. The only trick was finding a tool that
knew what files it was looking for. The camera that took the video clips was a
Sony and apparently they record into `m2ts` files, which are kind of a unique
format in that they only show up on Blu-Ray discs and Sony camcorders. Enter my
favorite two tools for dealing with potentially-destroyed data: `ddrescue` and
`photorec`.

`ddrescue` is a godsend of a tool. If you've ever used `dd` before, forget
about it. Use `ddrescue`. You might as well `alias dd=ddrescue` because it's
that great. By default it has a plethora of additional options, displays the
progress as it works, recovers and retries in the event of I/O errors, and does
everything that good old `dd` can do. It's particularly good at protecting
partitions or disks that have been corrupted or damaged by rescuing undamaged
portions first. Oh, and have you ever had to cancel a `dd` operation? Did I
mention that `ddrescue` can pause and resume copies? It's that good. 

`photorec` is probably the best missing file recovery tool I've ever used in my
entire life. And I've used quite a few. I've never had as good results as I've
had with `photorec` with other tools like Recuva et. al. And `photorec` isn't
just for photos, it can recover documents (a la Office suite), music, images,
config files, and videos (including the very odd `m2ts` format!). The other
nice thing is photorec will work on just about any source.

- plus scan whole partition