LINUX DATA RECOVERY - TOP TOOLS

There are very few things that you need to consider because most of the data recovery tools work in a similar manner by accessing the fragmented bits on your hard drive.

The major differences are usually in the ease of use, user interface, and features. So let’s go over the features and functionality of the top 20 best Linux data recovery tools in this article.

1. TestDisk – Partition and Disk Recovery Tool

This is one of my favorite utilities. It’s a command-line based tool but is really easy to use and very interactive. The utility runs and starts working its magic by simply running the command.

We wrote a recent tutorial on the testdisk utility which walks you through the installation and the steps to recover files.

Some of the features of TestDisk:

• Recover deleted partitions
• Re-build partition table.
• Partition backup for EFI GPT partitions
• Rewrite MBR

2. Mondo Rescue – Network Drive Recovery Utility

Another really good command-line utility is Mondo Rescue which has a few unique features which are really helpful for people working on multiple different types of file systems. This is the one utility that has been used for decades to backup/restore/recover data from all types of storage devices tape drives too!

Some features of Mondo Rescue:

• Backup and restore between RAID and non-RAID devices
• Partition management – Resizing, partitioning, formatting, etc.
• Backup and restore between Linux and Windows devices including the MBR
• Verify the integrity of data.

3. ddrescue – GNU Data Recovery Utility

We’re still sticking with command-line utilities. This is a utility that was developed by GNU. This is a free and open-source utility like all the other utilities by GNU.

Some of the features of ddrescue:

• Created to be fully automated
• Data is rescued very efficiently (only the needed blocks are read).
• Auto-merge data
• Automatically highlights bad sectors on a hard disk
• Backup-Recovery is resumable

4. Redo Backup and Recovery – Easiest GUI Recovery Utility

This can work as a regular utility or as a bootable CD/USB that you can plug into any device, boot into the recovery utility, and start recovering data. The benefit of such a utility is that it is platform-independent allowing you to restore data for pretty much any operating system including Linux.

Some features of Redo Backup and Recovery:

• Pre-installed basic applications like browser, text editor, even when the recovery is running
• It can access other applications while recovery operations are running.

5. PhotoRec – Photo Recovery Utility

This is another recovery utility by CGSecurity (the other one is TestDisk). PhotoRec was specifically created for recovering deleted photos and other graphic style media from SDCards, and hard drives.

Some of the features of PhotoRec:

• Intuitive and interactive interface
• PhotoRec is able to recover files even if the hard drive is badly damaged
• Searches for a very wide variety of file formats.

6. Boot Repair – Live CD File Recovery

If your operating system no longer boots and you need to recover files from your hard disk, this is the live CD to use. It can be used as a CD or a USB based on availability.

Some of the features of Boot Repair Live CD:

• Repair booting when the OS doesn’t boot anymore
• Repair booting when GRUB is broken (eg. “GRUB rescue” error)
• Easy GRUB reinstall or restoration
• Allow generating a generic MBR to boot into Windows
• Allow restoring the original boot sector (MBR) if saved by clean-ubiquity

7. Foremost – A Forensic Data Recovery Tool

This is a forensic data recovery tool that is pre-installed in Kali Linux but can be installed on pretty much any other Linux distro. This tool can also recover data from images (like those created with the dd command).

Some of the features of Foremost:

• Retrieve data in multiple media file formats
• Configuration file available for adding more file formats
• Retrieve lost iPhone data from a computer
• Extract data elements that are embedded or lost from an image

8. Scalpel – A Cross-Platform File Carving Utility

Originally based on Foremost, Scalpel is another file carving utility that works on Windows and Linux. This utility also works on image files but has an added advantage of multithreading and asynchronous IO.

Some features of Scalpel:

• Multithreading on multi-core processors for faster processing
• Asynchronous I/O allows disk operations and search operations to overlap
• Regex support
• Embedded header-footer matching for better processing of files.

9. SystemRescue CD – An AIO Rescue Package Live CD

This is more of a collection of tools than a tool in itself. If you are stuck in a situation where you’re not able to boot into your system, this is the one bootable recovery CD that will help you out.

Some features of SystemRescue CD:

• GNU Parted: Command-line partition management
• GParted: Graphical implementation for the GNU Parted
• FSArchiver: Archiver software
• ddrescue: Find bad sectors on the hard drive
• Ntfs3g: For accessing Windows file systems.
• Testdisk: recover deleted partitions and files.
• Memtest: Memory testing utility.
• Rsync: remote backup utility
• Network tools: Samba-like utilities for backing up data over the local networks.

10. Ultimate Boot CD – A Collection of Almost All Data Recovery Tools

Similar to the SystemRescue CD, Ultimate boot CD is a collection of diagnostic tools. But it doesn’t end at that. If you see the above screenshot, you’ll notice “Parted Magic” and “UBCD FreeDOS”. Yes, that’s exactly what it says.

The CD also packages these two operating systems which can be booted live from this menu to troubleshoot any of your Linux or Windows issues. The full list of tools and utilities packaged inside this CD are available on the website but here is a list of a few of the tools.

Some of the features of Ultimate Boot CD:

• BIOS
• CMOS Cleaner
• CPUStress
• System Stability Tester
• MBR and GRUB recovery
• Login recovery
• PhotoRec and TestDisk
• Disk partition tools
• and more…

11. Knoppix – A Daily-Driver Capable Recovery Distribution

Now Knoppix is not your regular Linux recovery utility like the ones listed above. Though the entire purpose of this Linux distro was to be run live and recover lost data or operating systems, it is fully capable of being run as the sole operating system for your computer.

It comes packaged with almost all the tools you’d ever need to recover lost data.

Some of the features of Knoppix:

• GNU/Linux software
• Automatic hardware detection
• Support for many graphics cards, sound cards, SCSI and USB devices, and other peripherals
• Can be used as an educational disc, rescue system, or a Linux demo disk

12. GParted Live – The GUI Tool for GNU Parted

In some of the above Live CDs, we mentioned the GParted tool which is a GUI layer to the GNU Parted utility. Well, if all you want is the GParted tool for recovery, this live CD will solve your problem.

GParted Live is a live CD that gives you instant access to GParted if you want to recover a failing system or partition.

Some of the features of GParted Live:

• Debian-based Live CD
• Can manage partitions of all different types
• Comes packaged with testdisk and parted for which the GParted provides a Graphical layer
• Very intuitive with almost no learning curve

13. SafeCopy – One of The Best Linux Data Recovery Tools

The SafeCopy is one of the best Linux data recovery tools and works when all else fails. This tool is used for recovering data from damaged and bad sectors on a hard drive.

SafeCopy also tries to get as much data as possible from the source drive, even resorting to some device-specific low-level operations wherever applicable.

Some of the features of SafeCopy:

• Performs low-level IO operations to extract maximum possible data
• Remembers arbitrary recovery position even if the source device frequently disconnects (like USB drives that can lose connection due to faulty storage)
• Can fix errors in data on CDs, DVDs, and even Floppy drives

14. grep Command – Simple Text Data Recovery

The grep utility that we use for finding text on the terminal output is powerful enough to also help us find lost text data. Have a look at the code sample below:

• The -a specifies grep to consider the source as a text file
• The -A and -B specifies grep to find 25 lines before and 400 lines after this specific line is found. This allows us to get the entire text file and also, it’s better to have more data which we can later delete, than getting lesser one and having to run the command again.
• /dev/sdb1 is the source where we want the text to be searched for. We want the text to be searched on the entire drive
• > recover.txt will be where the output will be saved.

15. ext3grep – An ext3 File Recovery Tool

This is a command-line tool that is created for ext3 file systems for data recovery. With just two commands, you can recover and restore any deleted file that was recovered with this tool.

16. ext4magic – One of the Best Linux Data Recovery Tools for ext4

This is a command-line tool like many others in the list and is available from the package repositories for most Linux distributions.

Some of the features of ext4magic:

• Can recover entire filesystems that were recursively deleted
• Recover accidentally overwritten files
• Recover first-sectors of a hard disk that were accidentally overwritten

17. extundelete – An ext3grep Successor

This utility has its roots in the code of ext3grep. The ext3grep utility used the disk journal to recover files and so does the extundelete. This utility searches the disk journal for old copies of an existing inode to find more details and collectively forms it into a file.

Some of the features of extundelete:

• Recover from ext3 and ex4 partitions (a combination of #15 and #16)
• One of the programs to recover the file content and the file names on ext4 partitions
• ext4magic is based on extundelete for a lot of its ext4 recovery code

18. R-Undelete – IntelligentScan Data Recovery Technology

This is one of the best data recovery tools in Linux from the list. It has a free and a premium version but for personal use, it’s a completely free tool. It uses IntelligentScan technology that can recover severely damaged data too.

Some of the features of R-Undelete:

• MBR and GPT recovery
• Boot sector recovery on major file systems
• Recover files on ext, FAT, NTFS systems

19. ext3undel – A Custom Script to Simplify File Recovery

This is a script written to simplify the use of some of the complicated tools like Sleuthkit and PhotoRec and simplify them. Using these tools in combination also makes this script a more efficient method to extract more of the deleted inodes correctly.

Since this is a script that combines the functionality of multiple tools, the functionality is similar to the tools themselves.

20. The Sleuth Kit – Forensic Evidence

This is a tool that’s made specifically for forensic investigators to perform analysis on hard drives and collect evidence. So the Sleuth Kit uses very efficient and advanced algorithms to extract as much deleted data as possible from hard drives.

The previous tool that we talked about “ext3undel” leverages technology from the Sleuth Kit but if you would like to use this tool as a standalone one, you can use it along with it’s GUI front-end “Autopsy“

Some of the features of The Sleuth Kit:

• Timeline Analysis: View system events on a GUI
• Keyword Search: Find keywords in text files across the entire drive (including deleted files)
• Web Artifacts: Extract web activity data
• Registry Analysis: Find recently connected devices using the registry data
• LNK File Analysis: Identity recently accessed documents
• Email Analysis: Parses email messages in the mbox format for reading and analysis
• and many more features…

Conclusion

We hope you found the right tool for your data recovery needs with this article. For a basic user, pretty much any tool from the list will work. But for people who’ve special needs with file recovery, they need to find the one that has the features that they need.

Always remember though, these tools try to recover files that have been deleted based on the metadata that still remains. But that’s not a guarantee of recovery so it’s always best to have backups of all the data that’s being stored.