Recovering lost files

You have surely encountered a crash of your hard disk where a formatting of windows were not anticipated. Windows allows you sometimes to recover your files and folders with the tools system Restore. Moreover in most apparent times, it is not trustworthy that you will recover all your files. In certain cases, you cannot afford and accept to rely on almost. In this page, we will refer to you some tools that is reliable for recovering your files and folders.

Thanks to note that these proposed solutions do not make regular backups of your PC.

Summary

Preconditions

Do not save any files and documents on your hard disk or partition.
Use another support (partition, another internal or external hard disk, A ZIP disk etc.

Under Windows

Freeware

Below proposed recovery software are free and can be downloaded on proposed websites

PC Inspector File Recovery

Download website: http://www.pcinspector.de/Sites/file_recovery/info.htm?language=1
Operating systems: Windows 95/98/ME/NT/2000/XP
Features: File recovery for FAT 12/16/32 and NTFS file systems.
License: Freeware
Application: Windows

Restoration

Download website: http://www.download.com/Restoration/3000-2094_4-10322950.html
Features: File management for FAT 12/16/32 and NTFS file systems.
License: Freeware
Operating systems: Windows 95/98/ME/NT/2000/XP

Hand Recovery

Download website: http://www.handyrecovery.com/
Features: File management for system FAT 12/16/32, NTFS et NTFS5.
License: Freeware
Operating systems: Windows 95/98/ME/NT/2000/XP/2003
NTFS Undelete
Download website: http://ntfsundelete.com/
Operating systems: Windows 2000/XP
Features: File management for NTFS file system.
License: Freeware

Undelete Plus

Download website: http://undelete-plus.com/
Operating systems: Windows 95/98/ME/2000/XP
Features: File management for FAT 12/16/32, NTFS removable media system
License: Freeware

SoftPerfect File Recovery

Operating systems: Windows 95, 98, ME, NT, 2000, XP, 2003, Vista, 2008

Download website: http://www.softperfect.com/products/filerecovery/

System File management: FAT 12/16/32, NTFS and NTFS5.

License: Freeware

Photorec&Testdisk

System file management: FAT 12/16/32, NTFS, NTFS5, ext2/ext3 (Linux), HFS+, XBox.

Download website: http://www.download.com/TestDisk-PhotoRec/3000-2248_4-10511775.html

Operating systems: All windows version, Linux, BSD, Solaris, MacOSX. (This application may also be run under DOS).

Instruction for application

To use the above illustrated software, you should select the right partition which is recognized automatically.
The files to be recovered are listed.
You should select the files to be recovered and choose path for saving. The recovered file should be saved in other partition than the one crashed.

Notice

These software main purpose is to recover your files under a crashed partition and is not intended to repair a damaged partition. However it may that the file you are trying to recover are corrupted making it impossible for recovery.

You can now recreate partition using other different methods for example using partition tools or even formatting.

The fastest way to recover data from a damaged partition is to recreate an image of the specific partition.

Under GNU/Linux

Under another system GNU/Linux is installed and operational, you have to boot on.
If it does not function, you can use a GNU/Linux liveCD (Knoppix, Kaella, Slax, SimplyMEPIS, System Rescue)

To use the console, you must ensure that the partition for saving the files and folders are well formatted even on FAT32.

For more information, go to below website:
http://www.gnu.org/software/emacs/manual/html_node/emacs/After-a-Crash.html

Mount the partition as read-only

If the partition is not mounted :
mount /dev/partition /point/of/mount -r

If the partition is already mounted, unmount and remount using below command:
mount /dev/partition /point/of/mount -o remount,ro

If you should recover the root (/), add the option –n to avoid writing on /etc/mtab


Read manuals on :

http://linux.die.net/man/8/mount

http://linuxreviews.org/beginner/

Unable to mount

Use the fuser to identify what process uses this partition:

Use the command fuser to identify process used by this partition
:
fuser -v -m /point/of/mount

For more information on the fuser, see tutorials on:

http://linux.about.com/library/cmd/blcmdl1_fuser.htm

To disable the process:


fuser -k -TERM -v -m /point/of/mount

Files Recovery

Recover the files using the command lsdel:

echo lsdel | debugfs /dev/hda3 > list.txt

Print the list

Recover your files using debugfs. You must first of all use the command dump followed by dd.(see below)

debugfs: dump "148003" /recup/000

The above command allow to you to create the file 000 (in the file/recov) containing the corrupted data.
You will have to resize the file with the command dd

dd count=1 if=/recup/000 of=/correct/000 bs=6065

The file "000" (in the file /correct) should now be trusted.