John's Blog and Stuff

I have a program for recovering deleted files from a Windows-based PC, but it only runs when you can boot into Windows. This works pretty well, but if you're trying to recover files from the drive Windows is mounted on, you risk losing over-writing files (while booting into the OS) before you get a chance to recover them. Plus, it cost money to license it, so there has to be a better way...

I found a neat answer in an Ubuntu LiveCD, with an app called 'foremost' doing the heavy lifting. Here's the recipe and run-down, probably not suitable for the absolute beginner, but good enough for me to re-use a year from now when I've forgotten again:

1. Boot from an Ubuntu LiveCD (I used Ubuntu 8.10 Deskop Edition)
2. Mount the Windows partition for viewing (mine was /dev/sda1)
3. Plug in, and turn on, an external USB drive; make sure it mounts and shows up on the desktop (mine was /media/disk)
4. Switch to the USB drive ('cd /media/disk')
5. Enable the Universe and Multiverse repositories
6. Run 'sudo apt-get install foremost' in a shell window to install foremost (it doesn't come installed on Ubuntu Live)
7. Run 'sudo dd -i /dev/sda1 -o recover.iso' to copy the contents of sda1 to an iso image on your usb drive
8. Run 'sudo mkdir recovered' to create a target directory for your recovered files
9. Run 'sudo foremost -i recover.iso -o recovered/ -v' to actually recover the files (to the 'recovered' folder)
10. Run 'sudo chown -R ubuntu:ubuntu recovered/' to make the contents of the 'recovered' folder accessible

Foremost will have created a series of folders inside the desitination folder ('recovered', in my example), categorized by files type. Any recovered files will be found inside them.

A couple thoughts:

• You probably don't really need to create an iso image of the drive first, though I didn't try it without. I like doing it this way, because once you've got the iso, you can leave the 'real' disk alone and work from the iso.
• You may have to 'force mount' the Windows partition, especially if it was so corrupted that it wouldn't boot. I won't cover that here, but Google will snap up plenty of examples of how to do it
• Thanks to this blog post for much of this idea and instruction. Also check out the man page for foremost
• Foremost comes pre-configured (check /etc/foremost.conf for details) to recognize a number of the most popular file types. Adding more files types is beyond the scope of this little article - and probably a step out of my own reach, for that matter. No matter, though...most of the files that are going to be important fit in that 'popular type' category.