Recovering lost files

When your hard disk, accidentally crashes, resulting in the formatting of the Operating System (Be it Windows or Linux), it often leads to the loss of some important files. An Operating System like Windows may not be enough to recover these. Theonly option left in such cases is to use some Freeware applications like PC Inspector File Recovery, Restoration, Hand Recovery Undelete Plus, Soft Perfect File Recovery, Photorec & Testdisk etc. Similarly, in GNU/Linux, with a Live CD, the Active partition has to be mounted as root user and using command lines files can be recovered subject to the partition not being damaged.



You have probably encountered an unexpected crashing of your hard disk at some point or another. Windows sometimes allows you to recover your files and folders with the tools system Restore. However, most of the time it cannot be trusted to fully recover all your files. In this page, we will refer you to some tools that are reliable for recovering your files and folders.

Please note that these proposed solutions do not make regular backups of your PC. Do not save any files and documents on your hard disk or partition.
Use another support (partition, another internal or external hard disk, A ZIP disk etc. Here are some free recovery software that can be downloaded from specific websites. Download website: PC Inspector File Recovery
Features: File recovery for FAT 12/16/32 and NTFS file systems.
License: Freeware
Application: Windows Download website: Restoration
Features: File management for FAT 12/16/32 and NTFS file systems.
License: Freeware Download website: SoftPerfect File Recovery


System File management: FAT 12/16/32, NTFS and NTFS5.

License: Freeware Download website: http://www.handyrecovery.com/
Features: File management for system FAT 12/16/32, NTFS et NTFS5.
License: Freeware
NTFS Undelete
Download website: http://ntfsundelete.com/
Features: File management for NTFS file system.
License: Freeware Download website: http://undelete-plus.com/
Features: File management for FAT 12/16/32, NTFS removable media system
License: Freeware System file management: FAT 12/16/32, NTFS, NTFS5, ext2/ext3 (Linux), HFS+, XBox.
Download website: Photorec&Testdisk
Operating systems: all Windows versions, Linux, BSD, Solaris, MacOSX. (This application may also be run under DOS). To use the above illustrated software, you should select the right partition which is recognized automatically. The files to be recovered are listed. You should select the files to be recovered and choose the path for saving. The recovered file should be saved in other partition than the one crashed. The main purpose of these software is to recover your files under a crashed partition and are not intended to repair a damaged partition. However it may be that the files you are trying to recover are corrupted making it impossible to recover them.

You can now recreate a partition using other different methods for example using partition tools or even formatting.

The fastest way to recover data from a damaged partition is to recreate an image of the specific partition. Under another system GNU/Linux is installed and operational, you have to boot on.
If it does not work, you can use a GNU/Linux liveCD (Knoppix, Kaella, Slax, SimplyMEPIS, System Rescue).

To use the console, you must ensure that the partition for saving the files and folders is well formatted even on FAT32.

For more information, go to the below website:
http://www.gnu.org/software/emacs/manual/html_node/emacs/After-a-Crash.html If the partition is not mounted :
mount /dev/partition /point/of/mount -r

If the partition is already mounted, unmount and remount using the below command:
mount /dev/partition /point/of/mount -o remount,ro

If you should recover the root (/), add the option -n to avoid writing on /etc/mtab


Read manuals on :

http://linux.die.net/man/8/mount

http://linuxreviews.org/beginner/ Use the fuser to identify what process uses this partition:

Use the command fuser to identify the process used by this partition:
fuser -v -m /point/of/mount

For more information on the fuser, see the tutorials on:

http://linux.about.com/library/cmd/blcmdl1_fuser.htm

To disable the process:


fuser -k -TERM -v -m /point/of/mount Recover the files using the command lsdel:

echo lsdel | debugfs /dev/hda3 > list.txt

Print the list.

Recover your files using debugfs. You must first of all use the command dump followed by dd.(see below)

debugfs: dump "148003" /recup/000

The above command allows to you to create the file 000 (in the file/recov) containing the corrupted data.
You will have to resize the file with the command dd

dd count=1 if=/recup/000 of=/correct/000 bs=6065

The file "000" (in the file /correct) should now be trusted.
Published by netty5. Latest update on February 23, 2018 at 11:46 AM by Jeff.
This document, titled "Recovering lost files," is available under the Creative Commons license. Any copy, reuse, or modification of the content should be sufficiently credited to CCM (https://ccm.net/).
Windows XP - Disabling the Security Center
Fixed IP or Dynamic IP address