Have you ever had a digital camera SDD card get corrupt and become unreadable? Through the use of the handy tool photorec, all the files on the card can be recovered.
First you need to install photorec. It’s included in a package called testdisk. This package was available in the CentOS/RHEL epel repos as well as the Fedora 14 repo.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39
% sudo yum install testdisk Loaded plugins: langpacks, presto, refresh-packagekit Adding en_US to language list Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package testdisk.x86_64 0:6.11-6.fc12 set to be installed --> Finished Dependency Resolution Dependencies Resolved ==================================================================================================================================== Package Arch Version Repository Size ==================================================================================================================================== Installing: testdisk x86_64 6.11-6.fc12 fedora 257 k Transaction Summary ==================================================================================================================================== Install 1 Package(s) Total download size: 257 k Installed size: 859 k Is this ok [y/N]: y Downloading Packages: Setting up and reading Presto delta metadata Processing delta metadata Package(s) data still to download: 257 k testdisk-6.11-6.fc12.x86_64.rpm | 257 kB 00:02 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Installing : testdisk-6.11-6.fc12.x86_64 1/1 Installed: testdisk.x86_64 0:6.11-6.fc12 Complete!
First put your SDD card into a card reader attached to your Linux box. Next you’ll need to run photorec.
I’ve never tried either of these tools but in case the above causes you problems or you’re looking to recover other types of files they may be helpful to you, so I list them here for the “just in case”.
The first one is called formost.
Foremost is a forensics application to recover files based on their headers, footers, and internal data structures. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. This short article shows how you can use foremost to recover deleted files.
There’s a good howto over on HowtoForge to get you started with it quickly.
The second tool is called scalpel.
Scalpel is a fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery. This short article shows how you can use Scalpel to recover deleted files.
There’s another good howto over on HowtoForge to get you started with it as well.