LWM-Linux/14 - Linux Troubleshooting and Recovery/Data Recovery Techniques.md

Data Recovery Techniques

1. Understanding Data Loss Scenarios

• Accidental deletion
• File system corruption
• Hardware failure
• Malware or cyber attacks
• Improper system shutdown

2. Preparation for Data Recovery

• Stop using the affected drive immediately
• Boot from a live Linux distribution (e.g., Ubuntu Live USB)
• Prepare a separate storage device for recovered data

3. File Recovery Tools

a) TestDisk

  - Powerful, open-source tool for recovering lost partitions
  - Can fix partition tables and recover deleted partitions
  - Usage: `sudo testdisk /dev/sdX` (replace X with the appropriate drive letter)

b) PhotoRec

  - File carver that can recover various file types
  - Works even when the file system is severely damaged
  - Usage: `sudo photorec /dev/sdX`

c) Foremost

  - Forensic data recovery tool
  - Recovers files based on headers, footers, and internal data structures
  - Usage: `sudo foremost -i /dev/sdX -o /path/to/output/directory`

d) Scalpel

  - Another file carver with a configurable database of file types
  - Usage: `sudo scalpel /dev/sdX -o /path/to/output/directory`

4. Command-Line Data Recovery Techniques

a) Using dd to create a disk image

  - `sudo dd if=/dev/sdX of=/path/to/disk_image.img bs=4M conv=noerror,sync`
  - This creates a bit-by-bit copy of the drive for safer recovery attempts

b) Recovering deleted files with extundelete (for ext3/ext4 filesystems)

  - `sudo extundelete /dev/sdX --restore-all`

c) Using grep to search for specific file content

  - `sudo grep -a -C 100 "unique_string" /dev/sdX > recovered_data.txt`

5. File System-Specific Recovery Techniques

a) Ext3/Ext4

  - Use e2fsck for filesystem check and repair: `sudo e2fsck -f /dev/sdX`
  - Recover journal: `sudo debugfs -w /dev/sdX`

b) NTFS (for dual-boot systems or external drives)

  - Use ntfsfix: `sudo ntfsfix /dev/sdX`

c) XFS

  - Use xfs_repair: `sudo xfs_repair /dev/sdX`

6. Advanced Recovery Techniques

a) File Carving with Sleuthkit

  - `sudo fls -r /dev/sdX`
  - `sudo icat /dev/sdX [inode] > recovered_file`

b) Using ddrescue for damaged drives

  - `sudo ddrescue /dev/sdX /path/to/image.img /path/to/logfile.log`

c) Recovering RAID arrays

  - Use mdadm to reassemble the array: `sudo mdadm --assemble --scan`

7. Data Recovery from SSDs

• Use hdparm to check if TRIM is enabled: sudo hdparm -I /dev/sdX | grep TRIM
• If TRIM is enabled, recovery chances are significantly reduced
• Use specialized SSD recovery software like R-Studio or ReclaiMe

8. Prevention and Best Practices

• Regularly backup important data
• Use journaling file systems
• Implement RAID for critical systems
• Properly shut down systems
• Use UPS to prevent power-related issues

9. When to Seek Professional Help

• Physical drive damage
• Critical data with high monetary or sentimental value
• Legal or compliance requirements

10. Legal and Ethical Considerations

- Ensure you have the right to recover the data
- Be aware of data protection laws and regulations
- Handle sensitive recovered data with care

Remember that data recovery success rates vary depending on the specific scenario and the time elapsed since data loss. Always prioritize creating a backup before attempting any recovery techniques to avoid further data loss.