LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (http://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   data recovery in linux (http://www.linuxquestions.org/questions/linux-newbie-8/data-recovery-in-linux-643453/)

yadava 05-20-2008 05:37 AM

data recovery in linux
 
hi all
is there any possibility of data recovery in linux as like windows
as we know that there is no concept of drive in the linux
despite is there any possibility of data recovery in linux after formating it
if YES then which one software we can use.

premnarayan 05-20-2008 07:47 AM

I accidentally quick formatted my reiserfs partition as fat32 in windows. Got most of the data back (along with some ghost files) by rebuilding the filesystem tree.
As long as you do not overwrite data (a slow format, I believe, deletes actual data on disk), it is usually possible to recover. Check out rescue cds, they have tools to do that. Also there is this famous ddrescue, you may want to read about!

b0uncer 05-20-2008 08:31 AM

In addition there are a lot of commercial and non-commercial data/file recovery programs out there, some of which have versions for Linux too, not just Windows (though it seems Windows is more usual OS for those apps). They might or might not work, but writing files to the disk does increase the possibility of overwriting the data you are trying to restore, so try not to do that. You could even make a 1-to-1 copy of the partition/disk with dd and work with that copy if you wanted; that way the original wouldn't get accidentally overwritten.

When a file is "removed", it is just unlinked - the data is not removed, but the file name in the filesystem is simply unlinked from the data portion, meaning that the data is sort of "marked free" - when something is written to disk, it can be written there if needed. Actually there is no way to "remove" data, just write on it - though somebody might consider it "removing" if one writes for example zeros over the data. And there are programs like shred*that overwrite certain files, partitions or even disks as many times as the user wants (for example 15) to make sure that the original data would be as difficult to fetch as possible, or even impossible. Though journalling filesystems, like ext3, make the use of such programs usually nonsense, because of the journalling - instead of files programs like shred can still work with whole partitions, because then the data doesn't depend on a filesystem's way to represent it.

So in short, try searching the web for programs that claim they can restore deleted files. That's probably the best bet..and if the data is really valuable (as in you're ready to pay to get it back, possibly a lot), then you can take the disk to a company that has big equipment for restoring data - for example suitable lab for opening the harddisk without damaging it and working directly on the disks inside rather than trough the disk's own connectors and read head. Some of such companies say they can restore data even in very bad cases, but of course it costs money.

If people remembered to take backups, this all wouldn't matter. Most people just don't bother.


All times are GMT -5. The time now is 06:30 PM.