dares: Qui audet adipiscitur

I don’t have a proper home page for dares, so if you can track it down, let us know where the original is found. Until then, here’s the Linux Mint version and the Debian package page.

dares is a CD recovery tool which apparently can retrieve data even from unmountable discs. As luck would have it, I don’t have any unmountable discs, so my leftover PLOP boot disc will have to suffice.

dares needs little more than a device address (or file name, in the case of a corrupted image, which is also a potential target) and a directory to place its files before it will swing into action.

After reading the disc content, you get a straightforward menu for recovering and saving accessible data. Fairly foolproof, and fairly reminiscent of photorec or a few other data recovery tools.

Beyond that point though, I can’t really vouch for dares any more than I could for foremost or safecopy, just because I don’t have a damaged medium to test. If you do, and you’ve found your way to this page, I can only hope it does the trick for you.

Keeping this — as well as the other three I mentioned — in mind when I do stumble across a damaged drive … well, that’s the other trick. 😉

scalpel: File extraction and recovery

I am a newcomer to scalpel, so I didn’t know what a “file carver” was when I started it. But now I like its style.

I’m using an old floppy image from a couple of years ago, and asking scalpel to pluck out any files it finds that match certain types.

What you can’t see there is the configuration file, which is where most of your control over scalpel will reside.

If you’re looking for specific types or file extensions, you uncomment them in the conf file and scalpel will include them in its search.

In my case, this avoids the need to write out that image to a floppy, mount it, and go digging for the file manually. Oh, so tiresome. 🙄

Of course you don’t have to use scalpel on images, just a /dev/sdXY location should work as well.

scalpel is in both Arch and Debian; the AUR version yields a 404 though. Look at the comments on that page to get an archived link to the source file.

safecopy: If only I needed something safely copied

Oh, the S section. This is the part I’ve been dreading for almost a year, wondering exactly how long it would take to wade through this section of the list.

I have 114 titles in this part, though some of those are repeats and still more are of dubious usability. Might as well get started. This will bring us out of the spring, no doubt.

And first on the list is … safecopy.

Wouldn’t you know it? First program I get, I can’t really put to use. 😥

safecopy looks like a decent data recovery tool, and seems to have enough options to satisfy unusual arrangements.

Unfortunately, or perhaps fortunately, I’m fresh out of damaged CDs, sketchy hard drives and scratched floppies. Just my luck.

This is one I will keep in the back of my mind though. No doubt it will prove its worth in time. 🙂

rdiff-backup: Mirrored, with increments

I charged into rdiff-backup thinking it would be only a little more complex than rdiffdir was yesterday. Luckily I wasn’t too far off the mark.

rdiff-backup can make backups while conserving bandwidth, which is probably a great idea on the whole. It also makes incremental backups, and the home page promises file recovery over previous backups too.

I didn’t delve that far into it, but I do have a little to show for my effort:

My hope there was to show that rdiff-backup’s product is not only a mirror image of the source, but also includes data on what changed between runs. It might be a little difficult to follow; trust me if it’s not obvious.

Compared to a straight rsync, I can see where this would be preferable, if it conserves bandwidth and can offer access to past backups as well. I usually just refresh my archives with a simple rsync -ah --progress --delete, and there have been times I wished I could step backward once or twice in history.

On the other hand, this is very clean and straightforward, without a lot of the wrangling that I’ve seen in some other console-based backup tools. Given the need — such as a large-scale networked system — I’d definitely think this over as an option. 😉

photorec: Taught me something new today

I just had a very, very illuminating session with photorec, which might be strangely named considering what it can do, but is still a great console application.

photorec is part of the testdisk suite (or at least it is in Arch), but it doesn’t just recover photos. It can scrape through a drive and recover almost anything.

And from almost any filesystem, I might add, although you’ll need to know beforehand what the filesystem is.

photorec is menu driven for the most part, requires elevated privileges (which is good), and as far as I can tell in my experiences with it, does a great job yanking files from the jaws of death.

Now, why did I say “illuminating” earlier? Well, in one of my test runs this morning I grabbed a leftover flash drive that I hadn’t used in a while, ran dd over it for a few seconds, repartitioned it, dumped a couple of text files on it, deleted them, and then sent photorec to work.

Originally the drive had been formatted in ext4, but I repartitioned it to hold a vfat partition, just because I wanted to see what photorec would do with a non-Unix drive.

photorec found the original text files I dropped there a few minutes earlier, then kept scrounging and found music files I had on the drive before I repartitioned and reformatted it. I kid you not. 😯

And … they played perfectly in mocp. 😯

Until this morning I assumed that data files from completely different file systems on drives that had been repartitioned and reformatted … would be irretrievable. How wrong I was. 😳

I know enough to realize that without letting dd run its course over the whole drive, that data was still exposed. But I honestly thought since they weren’t listed in file table or were in a completely different filesystem, they wouldn’t be so easily brought back.

But there you have it. photorec taught me something new today, and I am wiser for it. Now please excuse me while I rig an entire laptop to run dban over every drive I own. … 😕

giis: The benefit of the doubt

I owe a couple leftover posts to severe network issues last weekend, so here are a couple of extras for today:

It’s unusual for me to find software that’s not in Arch/AUR and not in Debian, but is packaged in another distro.

Or maybe I just don’t go looking enough. Regardless, I believe giis is in Fedora, but some assembly might be required, if you’re using something else.

giis is an undelete tool specific to ext2 and ext3, but with a spinoff version for ext4. As best I can tell, giis doesn’t handle anything outside of those three filesystems. That’s not uncommon for what I can tell though; I have yet to run into a universal undeleter for Linux. 🙄

At this point, I have to make a disclaimer: I couldn’t get giis to run fully under Arch. Nine times out of ten, that’s because I’ve done something wrong, so don’t blame giis for that.

I got as far as the startup menu, but most options insisted I install giis (which I thought I had) or spat out errors (which suggests I misconfigured it).

And knowing that it’s packaged in Fedora, and has won a few application awards, I have a strong feeling I set it up wrong.

So I will give giis the benefit of the doubt, and say it’s my error that’s keeping it from running on my system. If you’re a Fedora user, please give it a turn and tell me how it worked.

foremost: Aggressive data recovery

Some of the tools I run across, I’m a little scared of. Sometimes I find applications that I’ve never heard of, and even if I have a measure of confidence that I could use it, I’m not sure I’d want to.

foremost is like that. The home page is very reassuring, and I daresay that in a pinch I could rely on foremost to recover data, probably after using something like ddrescue.

But I’m not sure I’m game. Just the phrase “data carving” makes me shudder slightly.

As I understand it, foremost can read from physical drives or drive images, and uses file headers and footers to recover information chunks.

A lot of it is over my head. My best experiences with information recovery is limited to restoring deleted files. This might be a whole different game.

I plan to keep it in mind though. For as many times as I’ve shot my mouth off and suggested that a tool was somehow beyond my reach, there have been an equal number of times where I’ve come back, years later, to realize how useful it was.

I have a feeling this is one of those times. 😐

ddrescue: No relation to the aforementioned dd

I’ve never used ddrescue, and I count myself among the lucky for that. In the same vein, I doubt I could show much in a screenshot that would be instructive.

The few times I’ve run into complete disk failures, I had sufficient backups to make ddrescue more work than it would be worth.

What I’ve learned about ddrescue makes it quite impressive though. For one thing, the program is less than 10 years old, which makes it a baby by most Linux standards.

ddrescue is also apparently designed to do the least additional damage to a malfunctioning drive; how exactly that works is a mystery.

But what I liked most was the idea you could run it repetitively without the chance of losing data. As I understand it, rather than writing zeros where data can’t be recovered, a later pass might add information that was found. I’ve probably explained it badly; the home page does better.

Like I said, I’ve never had the occasion to use ddrescue and I hope that’s always the case. On the other hand, I have a strange wish that I did have a crippled drive, just so I could try it out. 😐