Recover lost data using Foremost, Scalpel and Photorec...

In this post we'll see how to recover data from  your hard drives.Many-a-times we lose our precious files to shift-delete mania! 
Once you accidently delete your files you can still recover these files  from your PC thanks to these tools below but we need to do some  preparatory 
work before we recover files.

 



 First you should calm down! You will do more harm than good if you 
         are panicking!
 
Second, find an external drive or storage big enough to store your backup
         of the drive you want to recover the files from.You don't want to lose
         anymore data while  recovering the old data!
 
Third, make a folder recovery on the external drive to 
         store the recovered files.

Now let's see these tools...

1. Foremost: This is a good tool to recover the files from a drive.
         It is a console based program.First you should install
         Foremost. 
            sudo apt-get install foremost

         Find the name of your disks using command
            sudo fdisk -l  

       
         You can also find the size of the partition using
            sudo fdisk -s /dev/sda1   (name of the partition is /dev/sda1)
             
         Now i wanted to recover the data from a pendrive and it's name
         is /dev/sdb1
         So here's the data recovery part:
         
         Create an image of the drive by this command:
             sudo dd if=/dev/sdb1 of=/home/mypendriveimage.img  
         (Make sure you have sufficient space for output image)                         
         Remember this takes some time so be patient!
         Change ownership of image:
             sudo chown name.name /home/mypendriveimage.img

         Now make recovery folder in the drive you want to save the
         recovered files.I'll use my home folder.
             mkdir ~/recovery
        
         Now i'll recover pdfs from pendrive image.You can recover
         other type of files by appending the file types after
         -t option using commas(,).
              foremost -vqQ -o recovery/ -t pdf -i mypendriveimage.img

         And after this completes check your recovery folder!


2. Scalpel : It is also a good tool to recover files.It is based on foremost
         but it requires you to edit a configuration file before you can
         recover files from the drive.
       
         First you should install scalpel.
              sudo apt-get install scalpel
            
         Edit your configuration file using gedit
              sudo gedit /etc/scalpel/scalpel.conf
         

         
         Remove the # sign before the file types you want to recover
         and save the configuration file.

         Now run the following command to recover data.
             sudo scalpel /dev/sdb1 -o ~/recovery  (my output folder is recovery)

         Make sure you have proper space or the process won't complete!

         Once this completes check your recovery folder!

3. Photorec : This is also a command line tool but the interface is very good.
          Download photorec from here:
          http://www.cgsecurity.org/testdisk-6.13.linux26.tar.bz2
          If you know how to install from source then good but if you don't
          look here.

          Once you have installed photorec run it by using this command
              sudo photorec
         
          Select the drive from which you want to recover data:

             
          Select partition type,partition,file system and directory:

              
           Select the file types to recover:

                  

             Choose the location to store files:

        
           and hit enter!
            
           Check the directory to view recovered files!


          If you liked this post don't forget to like and share it with 
        your friends.You can also comment below if you have anything
        to ask or suggest...