First

Tutorial Steps Beginner-level tutorials

First Steps
for users dipping their toes into Linux

Recovery: Save
Think your precious files are lost forever? Think again. Jonathan Roberts
explains how to recover missing data using two indispensable applications.

Unetbootin lets you make bootable live CDs in Windows,

so even if your machine’s broken you can use a friend’s.

grab the testdisk package, which is found in most

distribution’s repositories. So, if you use Ubuntu, sudo apt-
get install testdisk should do the trick, and if you use Fedora
su -c “yum install testdisk” will get what you need.
If your lost files were stored on your own computer, the

I
In LXF149, Bob Moss walked us through some of the best thing to do is borrow a friend’s system and download a
best backup applications for Linux, demonstrating how live CD with testdisk on. There’s lots listed on the TestDisk
to keep your data safe in case of an accident. But even website, http://www.cgsecurity.org/wiki/TestDisk_Livecd,
after reading Bob’s words of wisdom, few of us back up as but we’d recommend the GParted live CD because it’s part of
often as we should, and this almost always leads to the a reliable project.
Our stomach-churning moment when you realise a crucial folder This is ideal because your friend doesn’t need to have a
expert is gone forever. Linux system, only a CD writer drive or a spare USB port. You
Super-secretive Fortunately, forever doesn’t always have to mean forever, can then use something like ISO Recorder or Unetbootin to
Jonathan and in this article we’re going to show you what to do when turn the downloaded ISO file into a bootable system. It also
Roberts
disaster strikes. We’ll be making use of the excellent TestDisk means that you won’t have to mount the hard disk to run the
has been
tinkering with and PhotoRec applications, which between them can recover tools, decreasing the risk of overwriting lost data.
Linux since he almost any file.
was a teenager. Before diving in, be sure to read the Where’d It Go box. It TestDisk to the rescue
Which actually explains what to do as soon as you know data loss has OK, now we’re ready to dive in and start rescuing some files.
wasn’t that occurred since, no matter how good TestDisk and PhotoRec We’ll begin by looking at how to use TestDisk to recover some
long ago...
are, if you don’t respond quickly and sensibly, there’ll be little files from a FAT32-formatted USB stick. Not only is this a
they can do. With a bit of knowledge and a bit of luck, however, common situation to find yourself in, learning this set of skills
your next data loss shouldn’t be such a terrible event. will be of most use to your friends and family as well, so it’s a
great place to start.
The tools for the job As we proceed, we’ll be keeping a close eye on how to
As with most Linux tasks, the first hurdle you must overcome operate TestDisk’s interface, since it’s far from consistent!
is installing the tools you need to do the job. With TestDisc With the USB stick inserted into the computer, open a
and PhotoRec, you’ll want to give a little extra thought to what terminal window and run the TestDisk command. Running it
format you grab them in, since it will depend on where your as a normal user will give you access to external disks and
lost files are located. If your lost files were on an external non-system partitions, but if, later on, you want to use it on
drive, then this won’t pose much of a problem: you can just system partitions, you’ll have to start it as root or with sudo.

Last month We learned how to secure data using the power of encryption.
76 LXF152 Christmas 2011 www.linuxformat.com

LXF152.tut_coreskills.indd 76 10/19/11 3:27:56 PM

 First Steps Tutorial

your lost files TestDisk+

PhotoRec 6.12

Which tool to use?

Once you’ve got the tools installed, maybe while installing a new distro. to save the day for friends and office documents: ODT, DOC
you’re probably itching to get Your partition was corrupted by a family and show off just how great and DOCX
started and see how much of your virus or faulty software and made Linux is. For a full list, see http://www.
data you can get back. unreadable. Unfortunately, there are few cgsecurity.org/wiki/File_
First, though, you need to know In these situations, TestDisk Linux distributions that use the old, Formats_Recovered_By_
which tool to start with – TestDisk will be able to recognise the lost but reliable, ext2 format for large PhotoRec.
or PhotoRec. partitions, copy the data off data drives. Instead, they mostly The best thing about it is that it
Each is best suited to different them, and sometimes even use ext3 or ext4, which aren’t works by ignoring the filesystem.
scenarios, so here we’ll have a restore the partition table to the supported by TestDisk. Instead it looks for unique
quick look at their strengths and way it was before. signatures left by certain file types.
weaknesses, so you know which to It’s also very good at recovering PHOTOREC Its website says that it definitely
use when. individual deleted files from FAT, This is where PhotoRec steps in. It works with FAT/ext2/ext3, but in
NTFS and ext2 formatted drives. was originally designed to recover reality it should work with almost
TESTDISK This is really useful since most lost photos, hence it’s name, but any block-based filesystem.
TestDisk was originally designed as USB sticks will be formatted in it’s since expanded to include It’s worth noting that PhotoRec,
a partition recovery tool, which either FAT or NTFS for almost any file format that’s in unlike TestDisk, is unable to
means that it’s best to use if your compatibility with Windows. common use, including: recognise filenames, so if TestDisk
problems arose after: Since this is the format used by archives: ZIP, TAR, TAR.GZ will work, that should be your first
Accidentally deleting a partition, Windows, it also gives you a chance media: FLV, MP3, MP4 and Ogg port of call.

TestDisk operates very much like a wizard, walking you The next screen will ask you to select which device you
through a series of steps to get your files back. want to work with. At the end of each device entry, you will Quick
After launching the application, your terminal will be see the device label, the name that’s displayed when you tip
taken over by TestDisk’s first screen, the log file screen. Here, open it in a file browser, which should make it easy for you to In TestDisk, use
you’re given the option of asking TestDisk to create a log file identify the correct one. a colon to add a
of all its activity, which can Navigation on this deleted file to your

“TestDisk operates like a

recovery selection.
be useful if you need to get screen works slightly The colour won’t
further support from a differently to before. You still change, but it will
forum or IRC. For our wizard, walking you use the cursor keys, and by have been selected.

through a series of steps.”

purposes, though, we’re just default the Return key
going to select No Log. selects the currently
You navigate your way highlighted device, but
around this screen, as with all of TestDisk’s screens, by using there’s also an array of further options displayed at the
the cursor keys. Pressing Up or Down highlights a different bottom of the screen.
option and pressing Return selects the item that you’ve As you might imagine, you can navigate these using the
currently got highlighted. Left and Right arrow keys. Bear in mind that the Return key
actually operates on these options, not the currently
highlighted device, so if you move away from Proceed, make

Even though TestDisk is text-based, its wizard-based TestDisk makes use of a number of different interaction methods, so be sure
interface makes using it a breeze. to keep an eye on the bottom of the screen.

If you missed last issue Call 0844 848 2852 or +44 1604 251045
www.tuxradar.com Christmas 2011 LXF152 77

LXF152.tut_coreskills.indd 77 10/19/11 3:27:57 PM

 Tutorial First Steps

sure you return to it before pressing Return. This interface

pattern is repeated elsewhere in the program, so be sure to
keep an eye on the bottom of the screen for hidden goodies.
Next you’re asked to choose a partition type and about
90% of the time, you’ll need to select [Intel] Intel/PC
partition. This is the basis of all Windows compatible
devices, so, if you’re in doubt, it’s probably the option you’re
looking for.

Rescue files
Quick On the next screen, select the Advanced option (Return
tip works fine here) and then use the Right arrow key to select
In both Undelete. You’ll then see a list of all the files on the device.
applications, it’s Deleted files will be displayed in red, and will display
good to check When recovering partitions instead of files, you’ll need to
information such as last modified time and date, and the
you’ve got the right select the Analyse rather than the Advanced option.
disk by looking at filename at the very end of the line. If you hover over a
its size. But note directory, the Right arrow key will allow you to enter it and
that sizes are in
MB, so divide by
have a look what’s inside, and then the Left arrow key will Rather than risk overwriting other deleted files, they only ever
1,024 to get GB. bring you back again. copy deleted files off the disk and on to another.
As you can see by looking at the bottom of the screen, When you press one of the copy keys, you’ll need to select
there are various options you can perform on the files and a destination for the files to be copied to. By default, TestDisk
folders, and yet another new interface paradigm is will put you in your home directory, from where you can
introduced. No longer just restricted to arrow keys, there’s navigate with the arrow keys as before. If you want to put the
all kinds of hotkeys listed here: typing a colon will select a file files in the home directory, or whichever directory is currently
or folder, C will copy all selected files while c will copy the displayed, highlight the entry whose name is just a single dot
current file. ‘.’ and press C. And that’s all there is to it. Your files will now be
You might be surprised to only see copy options here, safe in whichever destination folder you selected, ready for
TestDisk
rather than anything to actually ‘undelete’ the file, but this is you to back up or do what you want with.
highlights
deleted files that entirely intentional on the part of the TestDisk developers.
it’s found in red. Rescue a partition
Excellent, but what happens if you managed to delete an
entire partition? Well, TestDisk can help with that, too.
As before, we’ll demonstrate using a FAT-formatted USB
stick, but the principles will be the same for any other disk. Of
course, if the disk happens to be on your main system and is
no longer bootable, you’ll have to get hold of a live CD from
which to run TestDisk.
The first thing to do is insert the USB stick and launch a
new terminal window to run TestDisk in. Then you can
proceed as above, making your way through the menus until
you reach the list that includes Analyse, Advanced etc. Here,
instead of selecting Advanced, choose Analyse and then
Quick Search. TestDisk will then examine your disk, looking
for evidence of old partitions that have since disappeared.
Very quickly it’ll respond and show a list of partitions that it
managed to discover.
If you’re unsure whether it’s found the correct partition or
not, there’s a few ways you can check. First, at the end of

Where’d it go?
When a file gets deleted, even if you remove it using the disk that it was stored on. If it was on What happens if you didn’t just delete a
from the trash, it’s not really gone. What a USB stick or an SD memory card, for single file, but accidentally corrupted an entire
actually happens is that the operating system instance, remove it immediately; if it was on partition? Well, the steps are the same, really:
marks it as deleted, and informs other your hard drive, then you’ll want to shut down as soon as you realise what’s happened, stop
applications that the space taken up by this file the computer and not touch it again until you’re using the device. In this situation, however, you
is now available for other uses. Until another ready to do the file recovery. may also find that since computers won’t be
application comes along and uses that space, This will minimise the chances that another able to recognise the contents of the device at
however, the file and its contents are still there. application will write over the old data, and all, they may prompt you to reformat it. Make
This means that if you ever delete a file by increase your chance of being able to recover sure you don’t agree to this, as it’s only going to
accident, the first thing you must do is stop the data. complicate matters.

Never miss another issue Subscribe to the #1 source for Linux on page 66.
78 LXF152 Christmas 2011 www.linuxformat.com

LXF152.tut_coreskills.indd 78 10/19/11 3:27:57 PM

 First Steps Tutorial

each partition’s entry in the list, you should see a label. If you With your data a little safer, let’s return your disk to the
recognise this, either as something you explicitly set or as way it was before the accident, saving lots of unnecessary
something that appears when you plug in your USB stick, copying. From the same screen at which you pressed P to list
then it’s probably the right partition. the files, simply press Return to proceed further, and then
The other thing you can do is press P to see a list of files select Write to restore the partition to the way it was. As
that can be found on that partition. If you do this and you see soon as you’ve done that, you should be able to reboot and
your files, with appropriate see your disk appearing
time stamps and names,
then you’ve definitely found
“All that’s left to do is exactly as it did before. All
that’s left to do is breathe a
the right partition. breathe a sigh of relief... sigh of relief... and back up

and back up your data!”

your data!
Make a copy There’s one other
Once you’re sure, we’d option that we should bring
recommend pressing P to list the files anyway, and then to your attention here, and that’s to perform a Deep Search. If
copying them all off the device. This way, if anything else goes the Quick Search failed, this option can sometimes find older
wrong, such as TestDisk failing to recover the partition, at or more badly damaged partitions. You may not have as
least your files will be safe (assuming TestDisk supports this much luck recovering files from disks that are this damaged,
kind of operation for the disk partition format). but it’s well worth a try. LXF

Step-by-step: Recovering files with PhotoRec

OK, so we’ve showed you how to rescue files user: what if you want to recover files from an PhotoRec, the tool that’s designed specifically
from Windows-compatible partitions, and how ext3 or ext4 partition, or maybe even ReiserFS for this situation. It works in a similar way to
to rescue entire partitions, but you’re a Linux or Btrfs? Here, we’re going to walk you through TestDisk, so it should be familiar.

1 Launch PhotoRec 2 Specify filetypes 3 Search the drive

Launch the photorec command from a On the partition selection screen, first select Return to the partition selection screen, and
terminal, and then proceed as before until File Opt to specify which filetypes you’re then select Search. On the screen that
you reach the partition selection screen. searching for – you don’t want to end up with follows, be extra thorough by opting to scan
20,000 files to hunt through. the entire drive.

4 Begin recovery 5 Twiddle your thumbs... 6 Rename files

Choose a destination for the recovered files, Go off and make a cup of tea or something... Success! Now, check your file manager and
and press C to begin recovery. Be warned, it see if it’s found the correct files. Make sure
can find a lot of files, so it’s best to select a you rename them, however, as PhotoRec
sub-directory you don’t mind getting messy. doesn’t recover filenames.

Next month Discover how to manage your music collection with Banshee.
www.tuxradar.com Christmas 2011 LXF152 79

LXF152.tut_coreskills.indd 79 10/19/11 3:27:59 PM