File Recovery -- Any Open Source Live CDs?

[John Collier]

I keep seeing threads and I keep getting questions (in person) about file recovery. Up until recently, I just always answered that they would need to go to a "pay as you go" service provider to get this done.

Now I have been introduced to several "freeware" and retail options for M$ Windoze (such as http://www.file-recovery.net/ and http://www.recuva.com/ ) which makes me very curious about other options available.

Since the Linux/Open Source world is usually light years ahead in other system tools, can anybody point me toward some Live CD that will accomplish the same goals?

A portable solution that does not require an HDD install and is system independent would be a WONDERFUL thing.

Bunnies for all who give a new and unique option (not for repeats) that fits the criteria.

[Steven E. Protter]

Shalom,

http://www.acronis.com
Thats the pay for option we use at work. It has a bootable DVD/CD that I believe is Linux based.

http://www.knoppix.org/

http://www.centos.org

http://www.ubuntu.com/

I use these distributions to recover and fix WINDOWS systems as well as Linux systems.

Ubuntu is wonerful. You can boot and use the OS normally and decide later if you want to isntall.

SEP

[John Collier]

Steven,

Unless I missed something on that web site you linked to, I see nothing more than backup software.

Perhaps I did not make it clear as to what I am searching for.

What I am looking for is a way to recover files that were "accidentally" deleted, were lost due to a major OS failure (without an existing full backup) requiring a reload, etc.

On a personal note, I have each of my Linux boxes backing up to each other every single day through rsync, which works very well. Of course, some people (home users mostly) do not do such a thing so they are more prone to data recovery needs, which is specifically what I am searching for here.

If I missed it on your link, please point me in the correct direction.

[dirk dierickx · Accepted solution]

Ugh, recovering deleted files on windows is easier to do because they have such a bad, lousy, insecure method of deleting files it is pretty easy to recover them.

unix systems are a little more precise and recovering deleted data is mostly a lost cause. sometimes it may work, but the success rate is pretty low.

one technique in the past was to 'dd' the entire disk until you came upon the sectors were the file previously was. this can still work for text files, but good luck on office files as they are not easy to recognize.

there is an howto available for ext2 (works on ext3 as well) - http://www.faqs.org/docs/Linux-mini/Ext2fs-Undeletion.html

Anyway, the message on unix/linux is - backup and/or snapshots. ofcourse the good thing is that these things can be automated to the max!

[Ulf Zimmermann]

For recovery purpose I often use RIP (Rescue is possible). You can find it at http://www.tux.org/pub/people/kent-robotti/looplinux/rip/

There is an .iso image available which can boot text only or X11 and the same also for PXE boot (my preferred method). RIP is based on debian, so certain things for HP servers don't work out of the box, for that purpose (like hpacucli) I have built my own RedHat EL3 images, loosely based on an older version of RIP.

[John Collier]

Dirk,

Great link with very interesting information. Hopefully I will never need it, but nice to know it exists if I do.

You also mention that it is pretty easy to recover files on M$ platforms/file systems. Any chance you have info on a live CD that will do that as easily as possible?

My father is usually the one hit with this kind of thing from my sisters and a bootable CD that would give him a quick little tool (GUI would be even better) to use in this instance would be kind of like "the cat's meow".

He knows almost nothing of Linux, so the more simple the better.


Ulf,

Your link appears to show much promise, but I see very little in the way of documentation for it. The change log is extensive and it looks, from the package list in the change log, like it should be able to handle the M$ file system but I would love some more info if you know where it can be found.

Have you personally used this? If so, would you be willing to share your experience with it?



Steven,

Still waiting on the confirmation on your link so I can know if we were on the same page or not. I hate to leave a resident of Mount Olympus hanging on points if I can keep from it. :-)

[John Collier]

Sorry Steven,

I feel like a month is more than enough time to wait on a confirmation or response of any kind. I wanted to be able to give you more pointage than that, but without any clarification it does not seem to be what I was looking for.

Now, I know I have seen it said above that there is many more options for file recovery in Micro$oft than there is for Linux (or any *NIX for that matter).

What might some of my Live CD-type options be for recovering files 'accidentally' deleted on that O$ platform be? Please tell me that there are some Open Source options for this that I have yet to find...

[Huc_1]

Have a look at this site
http://www.sysresccd.org/Main_Page

This is a linux bootable rescue cd I found this after I had some disk corruption and did try to use it ... but then decided it would be faster to go back to on a not so old backup on new disk... and have lived with the lost, so never got to try this cd ...

Well whatever hope this will proof helpfull.

Jean-Pierre Huc

[John Collier]

Huc,

Nice site and it also looks like a wonderful rescue disk for major system crashes as well as a few of the more standard disk tasks. I fine tool overall.

As luck would have it, a friend of mine just put my need for a file rescue system in high gear.

She has a newer laptop w/ M$ Vista. She has spent the last 3 months on a cruise ship collecting pictures the whole time, which she has been storing on said laptop.

Long story short, one thing led to another and ALL of the photos have been deleted.

I now have the laptop in my possession and I need to find something that will help me scrape as many of the deleted photos off of her HDD as humanly possible.

The Live distro above doesn't seem to offer that function. I need one that does if at all possible.

[Huc_1]

I found theses two links to opensource That seem to fit the bill ?, I have not tried this.. well not since I deleted some file on sd disk from a New Zealand tripe.. but on a fat file format... Vista may proof more tricky, anyhow keep us informed if this is any good.

http://www.cgsecurity.org/wiki/TestDisk
http://www.cgsecurity.org/wiki/PhotoRec

enjoy life.

Jean-Pierre Huc

[John Collier]

Huc,

Looks promising. I will check it out when I get back to the house and let everybody know what I learn.

Thanks!

[Steven E. Protter]

Sorry John about the non-response.

I was busy and missed the thread when it popped back to the top.

What we try to do at work is keep significant data on EMC nfs based storage. This has a nice snapshot feature that stores backups on disk.

For the systems themselves, we install acronis and it writes to CD or NFS.

Acronis does not meet the live CD criteria however.

The three live CD distributions I have you do meet this critera and can all write entire systems to tape, CD/DVD and NFS.

As a matter of fact, I use Ubuntu to recover data from trashed Windows systems.

None of the solutions totally meets the criteria of the question, therefore when I saw your clarification and re-read the question, I was satisfied with the reward.

You sounded somewhat irritated with me so I explain my response, non-response and beg for forgiveness for not following up sooner.

Do with this response what you may. I learned from and bookmarked the thread and am happy with the outcome.

Regards,

SEP

[John Collier]

Steven,

Not irritated with you personally, just frustrated with the situation in general.

I know you are one of the busiest people in these forums. All one has to do is to look at the amount of points you put on the board on a monthly, weekly, or even daily average to understand how one small thread such as this could miss your overburdened attention.

What frustrated me was that I was forced to give you, of all people such a low point award over such a trivial thing.

I could tell that you had most likely misread or misinterpreted the question and I truly wanted to believe that you would pull yet another rabbit out of you hat given the time.

I appreciate your efforts in these forums in general (as I am sure so many others do as well) and it is always an honor to have you chime in on my threads.

On the recovery note, I can verify Knoppix and Fedora Live to be wonderful tools for recovering general data from many a trashed M$ system. Knoppix is usually my tool of choice simply because it automatically makes all of the HDD partitions available at least in a read-only manner.

What I am specifically looking for this time is a bit different in the fact that the HDD is not trashed, but the user deleted the files, in error, and now need to be recovered if possible. This is a game I have not played prior to now and I admit to being a bit lost.

I think the tools that Huc pointed me to have great potential. I wanted to try them last night, but life got in the way. I will have to take another shot at it tonight.

Thanks again!

PS. Please rest assured that if I ever get irritated at you or anybody else here it is very, very likely that there will be little to no doubt about it. One of my weaknesses is keeping my feelings hidden on matters such as that. If you need verification on that, just ask Pete. I am sure that he will back me up on that one!


Make it a WONDERFUL day!

[Steven E. Protter]

Shalom,

This is really raw but here it is:

http://recover.sourceforge.net/linux/

http://home.fnal.gov/~muzaffar/undelete/README.html

I searched hard and found nothing that looked professional. I know such stuff exists for Windows.

The last link looks serviceable, though you need to catch the delete quickly to prevent the file's disk portions from being overwritten by other files.

What you have pointed out is a glaring hole in the Linux and possibly Linux world.

Though as I mentioned before NFS with snapshots on an EMC does accomplish the goal very expensively.

SEP

[John Collier]

Huc,

Sorry for the long wait on feedback for you.

You were SO close to having what I needed to recover my friend's PC/Windoze lost files with that last one! The biggest drawback to what you pointed out was that it required installation on the effected machine and was NOT a live CD.

The hunt continues....