When your hard disk
, accidentally crashes, resulting in the formatting of the Operating System
(Be it Windows
), it often leads to the loss of some important files. An Operating System
may not be enough to recover these. Theonly option left in such cases is to use some Freeware applications like PC Inspector File Recovery
, Restoration, Hand Recovery
Undelete Plus, Soft Perfect File Recovery
etc. Similarly, in GNU/Linux
, with a Live CD, the Active partition has to be mounted as root user and using command lines files can be recovered subject to the partition not being damaged.
You have probably encountered an unexpected crashing of your hard disk at some point or another. Windows sometimes allows you to recover your files and folders with the tools system Restore. However, most of the time it cannot be trusted to fully recover all your files. In this page, we will refer you to some tools that are reliable for recovering your files and folders.
Please note that these proposed solutions do not make regular backups of your PC.
Do not save any files and documents on your hard disk or partition.
Use another support (partition, another internal or external hard disk, A ZIP disk etc.
Here are some free recovery software that can be downloaded from specific websites.
Download website: PC Inspector File Recovery
Features: File recovery for FAT 12/16/32 and NTFS file systems.
Download website: Restoration
Features: File management for FAT 12/16/32 and NTFS file systems.
Download website: SoftPerfect File Recovery
System File management: FAT 12/16/32, NTFS and NTFS5.
Download website: http://www.handyrecovery.com/
Features: File management for system FAT 12/16/32, NTFS et NTFS5.
Download website: http://ntfsundelete.com/
Features: File management for NTFS file system.
Download website: http://undelete-plus.com/
Features: File management for FAT 12/16/32, NTFS removable media system
System file management: FAT 12/16/32, NTFS, NTFS5, ext2/ext3 (Linux), HFS+, XBox.
Download website: Photorec&Testdisk
Operating systems: all Windows versions, Linux, BSD, Solaris, MacOSX. (This application may also be run under DOS).
To use the above illustrated software, you should select the right partition which is recognized automatically. The files to be recovered are listed. You should select the files to be recovered and choose the path for saving. The recovered file should be saved in other partition than the one crashed.
The main purpose of these software is to recover your files under a crashed partition and are not intended to repair a damaged partition. However it may be that the files you are trying to recover are corrupted making it impossible to recover them.
You can now recreate a partition using other different methods for example using partition tools or even formatting.
The fastest way to recover data from a damaged partition is to recreate an image of the specific partition.
Under another system GNU/Linux is installed and operational, you have to boot on.
If it does not work, you can use a GNU/Linux liveCD (Knoppix, Kaella, Slax, SimplyMEPIS, System Rescue).
To use the console, you must ensure that the partition for saving the files and folders is well formatted even on FAT32
For more information, go to the below website:
If the partition is not mounted :
mount /dev/partition /point/of/mount -r
If the partition is already mounted, unmount and remount using the below command:
mount /dev/partition /point/of/mount -o remount,ro
If you should recover the root (/),
add the option -n
to avoid writing on /etc/mtab
Read manuals on :
Use the fuser to identify what process uses this partition:
Use the command fuser to identify the process used by this partition:
fuser -v -m /point/of/mount
For more information on the fuser, see the tutorials on:
To disable the process:
fuser -k -TERM -v -m /point/of/mount
Recover the files using the command lsdel
echo lsdel | debugfs /dev/hda3 > list.txt
Print the list.
Recover your files using debugfs.
You must first of all use the command dump followed by dd
debugfs: dump "148003" /recup/000
The above command allows to you to create the file 000
(in the file/recov) containing the corrupted data.
You will have to resize the file with the command dd
dd count=1 if=/recup/000 of=/correct/000 bs=6065
The file "000"
(in the file /correct) should now be trusted.