<<

Disk Recovery Tools

If you are looking to data from a drive that is least potentially failing, you should first resort to try to make a clone/image of that drive to a backup drive. Tools like DiskDrill on MacOS, or Clonezilla and DDrescue are great at doing this. can also be a great last resort OS to try to recover data from a drive if you keep running into issues on Windows or MacOS

pmount

dd / ddRescue

CloneZilla

Repair/Fix HFS+ (macOS) partition using

TestDisk pmount pmount manual pmount is a device mounting solution that simplifies mounting and will automatically try to remount any devices that may eject on their own. Very useful for doing on misbehaving drives.

sudo apt install pmount dd / ddRescue

Install ddrescue through the gddrescue package dd is a recovery tool probably found on every system. It is built to be lightweight, simple, and available. However, ddrescue (GNU) is sophisticated algorithm to read "good" or "big" blocks first and then more damaged areas later to reduce the amount of data read in a single operation.

Install gddrescue package containing ddrescue (GNU) by entering this command:

sudo apt install gddrescue

References

https://opensource.com/article/18/7/how-use-dd-linux

https://askubuntu.com/questions/803789/testdisk-is-showing-wrong-size-of-drive

https://superuser.com/questions/1024643/in-which-case-should-i-prefer-dd-over-gnu-

ddrescue

Manual

https://www.gnu.org/software/ddrescue/manual/ddrescue_manual.html CloneZilla

CloneZilla is useful disk cloning software that can be installed using Windows, MacOS, or Linux.

sudo apt install clonezilla

Using the uMount command, You will need to unmount the drives that you want to restore from / clone to:

umount /dev/yourdrive

#i.e.

umount /dev/sdb/

umount /dev/sdc/ Repair/Fix HFS+ (macOS) partition using Ubuntu

sudo apt-get install hfsprogs

# Use to the Mac Partition.

sudo fdisk -l

Disk /dev/sda: 465.8 GiB, 500107862016 bytes, 976773168 sectors

Units: sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 4096 bytes

I/O size (minimum/optimal): 4096 bytes / 4096 bytes

Disklabel : gpt

Disk identifier: 00006451-5A98-0000-F944-0000E3560000

Device End Sectors Size Type

/dev/sda1 40 409639 409600 200M EFI System

We want to do a check on the mac partition. sda1 is the EFI partition, so the mac partition should be sda2 (verify this in fdisk).

sudo fsck.hfsplus -fryd /dev/sda2

# -f will force a filesystem check even if the specified device is "clean".

# -r will try to rebuild the catalog file on the specified

# -y Tries to repair fielsystem errors automatically during the check TestDisk

If you are trying to recover data from a failing hard drive, try to clone the drive first. Resort

to TestDisk only if that fails. Also, you should really only try to use TestDisk on a recovered

image on a healthy disk rather than a damaged image on a failing drive. The reason to use it

in this way is because the write operations that TestDisk performs will likely aggravate or

further damage the failing drive more.

TestDisk is an excellent multi-purpose repair software. It can perform repairs on most partitions and partition tables, and make non-booting disks bootable again. It can also help in a pinch with data recovery, though you should run it on secured and recovered data only (see the warning above). Check https://www.cgsecurity.org/wiki/TestDisk#Filesystems for a complete list of supported filesystems.

Install TestDisk

On Linux, TestDisk is really easy to install via package management. Otherwise, if you use

TestDisk on Windows or MacOS you will have to compile binaries to run TestDisk on those platforms.

sudo apt upgrade

sudo apt update

sudo apt install testdisk

Basic Commands

Run TestDisk

sudo testdisk

Run TestDisk and provide debugging and a log file.

sudo testdisk / /log TestDisk - Data Recovery Examples https://www.cgsecurity.org/wiki/Data_Recovery_Examples