Recover lost files in Linux

Help! (again)

During my around-the-world trip I made a lot of photos. Of course, I am a good boy, so I uploaded them all to dropbox whenever there was an oppertunity. However, at some point disaster striked, and I was left with a 8Gb sd card which did not work anymore. How bad can things get.

So first there are 2 important steps to not loose your pictures:

  1. Do not (never!!!) buy Kingston SD cards I have had multiple Kingston SD cards dieing on me. Never ever buy them. There are plenty other brands with a much better reputation!
  2. Save your pictures to an other storage medium whenever possible I used dropbox for this, but an other service or an USB stick or …

Then if disaster strikes and you did loose (some) of your photos, then you could do the following (on linux):

  1. Backup your card in the most secureway
  2. Use recovery tools on this backup, while you leave your broken SD card in a secure place. 1. foremost 2. photorec 3. testdrive

So let us talk about these all. Note that I used these on one of my Archlinux boxes. They actually did manage to safe most of my data on the SD card.

Backup your data

This step is simple. Create a dd backup from that SD card:

$ sudo dd if=/dev/mmcblk0 of=~/broken_sdcard.dd bs=1M
Note that my SD card is mounted under /dev/mmcblk0, it might be in another position in your case (try to find it using dmesg tail right after you connected the card).

From now on I will only use the file broken_sdcard.dd when dealing with the raw data!

 

Foremost

You can find foremost’s website here. It worked very fast, and quite well. It is easy to use as I will show you here:

$ mkdir recovered1 $ cd recovered1 $ foremost -v -k 1024 -o ./ ~/broken_sdcard.dd

Note that I give foremost 1024 Mb of my internal ram to work with. This will speed up the process. Give it more when possible. Give it less when required.

During the execution of the last step, foremost will generate a lot of folders and fill them with the recovered files. The file audit.txt will tell you what foremost has found and recovered.

Photorec

You can find Photorecs website here. It worked very fast, and quite well. It is easy to use as I will show you here:

$ mkdir ~\recovered2
$ photorec ~/broken_sdcard.dd

Photorec will present you with a number of options. It is safe to play around with them (remember that you only work on a backup). To use the default (very sane) settings, do the following:

  • Proceed using the selected disk (if it is the broken_sdcard.dd)
  • Select search (on the unknown partition)
  • Select other (as most cameras use fat as partition format)
  • Go to the folder ~\recovered2 (in which all the found files will be stored)
  • Press C (= Shift + C)
  • The recovery is running

The recovered files are in the recovered2 folder.

Testdisk

You can find Testdisks website here. For me this tool work perfectly. It is easy to use as I will show you here:

$ mkdir ~\recovered3
$ testdisk ./broken_sdcard.dd

Testdisk will present you with a number of options. It is safe to play around with them (remember that you only work on a backup). To use the default (very sane) settings, do the following:

  • Proceed using the selected disk (if it is the broken_sdcard.dd)
  • Select Intel (as the target partition type)
  • Select Analyse (to let the tool figure out what partition it is dealing with)
  • Select Quick Search
  • Select write (to write the new partition table to the dd disk)
  • Confirm with a Y (= Shift + Y)
  • Quit the program

The broken_sdcard.dd now has/should have a partition table again. We start Testdisk again, but this time to actually recover the data. We perform the following steps:

  • Proceed using the selected disk (if it is the broken_sdcard.dd)
  • Select Intel (as the target partition type)
  • Select Advanced
  • Select the created partition
  • Select Undelete (as this is what we want to do)
  • Press “a” (non-capital A) to select all files and folders
  • Press “C” (= Shift + C)
  • Go to the folder ~\recovered3 (in which all the found files will be stored)
  • Press “C” (= Shift + C) and the copy process will start

The recovered files are in the recovered3 folder. In my case it found absolutely all files and their filenames. Especially the latter is a shortcomming of the other tools.