Recovering lost files
You have surely encountered a crash of your hard disk where a formatting of windows were not anticipated. Windows allows you sometimes to recover your files and folders with the tools system Restore. Moreover in most apparent times, it is not trustworthy that you will recover all your files. In certain cases, you cannot afford and accept to rely on almost. In this page, we will refer to you some tools that is reliable for recovering your files and folders.
Thanks to note that these proposed solutions do not make regular backups of your PC.
Summary
Preconditions
Do not save any files and documents on your hard disk or partition.
Use another support (partition, another internal or external hard disk, A ZIP disk etc.
Under Windows
Freeware
Below proposed recovery software are free and can be downloaded on proposed websites
PC Inspector File Recovery
Download website:
http://www.pcinspector.de/Sites/file_recovery/info.htm?language=1
Operating systems: Windows 95/98/ME/NT/2000/XP
Features: File recovery for FAT 12/16/32 and NTFS file systems.
License: Freeware
Application: Windows
Restoration
Download website:
http://www.download.com/Restoration/3000-2094_4-10322950.html
Features: File management for FAT 12/16/32 and NTFS file systems.
License: Freeware
Operating systems: Windows 95/98/ME/NT/2000/XP
Hand Recovery
Download website:
http://www.handyrecovery.com/
Features: File management for system FAT 12/16/32, NTFS et NTFS5.
License: Freeware
Operating systems: Windows 95/98/ME/NT/2000/XP/2003
NTFS Undelete
Download website:
http://ntfsundelete.com/
Operating systems: Windows 2000/XP
Features: File management for NTFS file system.
License: Freeware
Undelete Plus
Download website:
http://undelete-plus.com/
Operating systems: Windows 95/98/ME/2000/XP
Features: File management for FAT 12/16/32, NTFS removable media system
License: Freeware
SoftPerfect File Recovery
Operating systems: Windows 95, 98, ME, NT, 2000, XP, 2003, Vista, 2008
Download website:
http://www.softperfect.com/products/filerecovery/
System File management: FAT 12/16/32, NTFS and NTFS5.
License: Freeware
Photorec&Testdisk
System file management: FAT 12/16/32, NTFS, NTFS5, ext2/ext3 (Linux), HFS+, XBox.
Download website:
http://www.download.com/TestDisk-PhotoRec/3000-2248_4-10511775.html
Operating systems: All windows version, Linux, BSD, Solaris, MacOSX. (This application may also be run under DOS).
Instruction for application
To use the above illustrated software, you should select the right partition which is recognized automatically.
The files to be recovered are listed.
You should select the files to be recovered and choose path for saving. The recovered file should be saved in other partition than the one crashed.
Notice
These software main purpose is to recover your files under a crashed partition and is not intended to repair a damaged partition. However it may that the file you are trying to recover are corrupted making it impossible for recovery.
You can now recreate partition using other different methods for example using partition tools or even formatting.
The fastest way to recover data from a damaged partition is to recreate an image of the specific partition.
Under GNU/Linux
Under another system GNU/Linux is installed and operational, you have to boot on.
If it does not function, you can use a GNU/Linux liveCD (Knoppix, Kaella, Slax, SimplyMEPIS, System Rescue)
To use the console, you must ensure that the partition for saving the files and folders are well formatted even on
FAT32.
For more information, go to below website:
http://www.gnu.org/software/emacs/manual/html_node/emacs/After-a-Crash.html
Mount the partition as read-only
If the partition is not mounted :
mount /dev/partition /point/of/mount -r
If the partition is already mounted, unmount and remount using below command:
mount /dev/partition /point/of/mount -o remount,ro
If you should recover the root
(/), add the option
–n to avoid writing on
/etc/mtab
Read manuals on :
http://linux.die.net/man/8/mount
http://linuxreviews.org/beginner/
Unable to mount
Use the fuser to identify what process uses this partition:
Use the command fuser to identify process used by this partition
:
fuser -v -m /point/of/mount
For more information on the fuser, see tutorials on:
http://linux.about.com/library/cmd/blcmdl1_fuser.htm
To disable the process:
fuser -k -TERM -v -m /point/of/mount
Files Recovery
Recover the files using the command
lsdel:
echo lsdel | debugfs /dev/hda3 > list.txt
Print the list
Recover your files using
debugfs. You must first of all use the command dump followed by
dd.(see below)
debugfs: dump "148003" /recup/000
The above command allow to you to create the file
000 (in the file/recov) containing the corrupted data.
You will have to resize the file with the command
dd
dd count=1 if=/recup/000 of=/correct/000 bs=6065
The file
"000" (in the file /correct) should now be trusted.