In our previous guide on securely wiping the hard disk and removable media via Ubuntu Live and DBAN boot CD, we discussed that Windows based disk shredding applications don’t allow wiping the disk partition where Windows is installed. Similarly, there are a great deal of data recovery applications available for Windows such as Recuva, Power Data Recovery, Undelete 360, RecoveryDesk etc, which can seamlessly perform the data recovery operations over not only auxilirary disks, but also removable disks including USB drives, external hard disks, SD cards and so on. What if you want to recover data from disk partition that holds Windows? What would be the most convenient way to run disk recovery operation over an entire disk (including all basic, extended, logical partitions and unallocated space), especially when system fails to boot up?
Since Ubuntu Live disk enables users to run the OS in an isolated environment without having to follow standard OS installation method, you can use it to mount the hard drive and run the data recovery operations over the entire disk. Ubuntu open source repository includes 2 widely used tools namely TestDisk and Foremost, to perform low-level data restoration operations. You may also find these tools in numerous system diagnostics boot disks such as Hiren’s Boot CD to recover hard disk data without having to install the operating system.
Unlike other system diagnostic tools, Hiren’s Boot CD comes packed with a slew of utilities that you may need to fix the hard drive and system boot issues such as HDAT2 (Test/Repair Bad Sectors), ViVard, SMARTUDM, HDD ERASE, Hard Disk diagnostics for Maxtor, Fujitsu, Toshiba and Seagate, BootFix, MBR Save / Restore, DiskMan and more. If your hard disk has developed bad sectors over time, we recommend using Hiren’s Boot CD to run and repair bad sectors prior to recovering data. However, if you just want to get your deleted back from all disk partitions, Ubuntu Live CD is probably a better option.
In this post, we will discuss how to use Hiren’s Boot and Ubuntu Live CD to repair partitions and perform hard disk recovery operations.
Using Ubuntu Live Disk
Last week, we showed you how to create persistent Ubuntu Live USB, and use if for changing Windows 7 administrator and standard user account password. You can follow the steps for creating Ubuntu Live CD from said guide to recover data from hard disk and external storage mediums. Once created, reboot your system into BIOS menu by pressing ESC, F2, F10, F9 or other system defined key, and set external hard disk/USB as first boot option from boot menu. Once boot priority is changed, save changes made to BIOS and restart your PC. It will take you to Ubuntu Live boot menu, select Run Ubuntu from this USB option to load Ubuntu OS.
Ubuntu doesn’t come with TestDisk and Foremost tools, but you can download and install them by enabling community maintained open source software option in Synaptic Package Manager. This will download the list of open source software, so that you can easily find and install third-party applications. To begin, open Synaptic Package Manager from Administration menu, which is accessible from System menu.
From Settings menu, select Repositories.
This will open Software Source dialog, letting you enable an option to download open source software list. Under Ubuntu Software tab, enable Community-maintained Open Source (universe) option, and click Close.
Now, hit Reload to refresh the repository list.
It will start downloading the open source package list.
After the list is downloaded, it will start rebuilding search index. Once refreshed, type testdisk in Quick search, and hit enter. Now, right-click testdisk and select Mark for Installation.
Now, click Apply on toolbar to download testdisk. Similarly you can download and install Foremost tool; just enter the Foremost in Quick Search, right-click it to select Mark for Installation and apply the changes.
Once tools are installed, close the Synaptic Package Manager. Since TestDisk and Foremost are console applications, you need to open Terminal from Accessories menu (accessible from Applications menu) to use them.
While TestDisk is a widely-used specialized tool for repairing lost partitions, it has the ability to list down and recover deleted data from primary and removable hard disks. To begin, enter following command to run the tool.
When you run the tool, it will ask you to create a log file to save the recovery processes issues and errors. Just press Enter to create a log file, and to move to next step.
It will start finding internal hard disk and all attached removable drives. Once disk scanning is finished, select the disk that is to be scanned for recoverable data and lost partitions.
Now, you need to specify the drive partition table type from the list, which includes Intel, EFI GPT, XBox, Sun, and Mac. In our case, it’s Intel, so we will select Intel.
You will find TestDisk features in next step including Analyze, Advance (include Filesystem Utils), Geometry, MBR Code and more. Just select Analyze to analyze the partition structure and search for lost partitions.
It will first analyze partition structure and then list down lost partition(s). However, if it fails to find partitions, enter Quick Search.
After Quick and Deep search, TestDisk will be able to find the partition. It lets the user specify the partition characteristics. You can press P to make it Primary, L to Logical, E to Extended and D to Deleted, or A to add a partition. Now all you need is to press Enter to recover the partition. It will take you to main menu, where you can select Write and hit Enter. It will ask you to reboot the system to repair the lost partition of specified disk.
If you want to selectively view and recover deleted files, enter P to view all the lost files. The deleted files are shown in red color, while items in white represents current data. It shows files and folders at root location; you can change the directory by pressing R on keyboard, and then select the files/folders you wish to recover.
Recovering files and folders is easy. Select the folder/file, you want to recover, and press C. It will ask you to specify the output location where files are to be recovered. Just move to the location and press Y to begin copying item to specified location. However, if you want to explore a folder to, let’s say, copy data to Desktop/Recovered Data folder, move to Desktop location in the list and then press Enter, it will open the Desktop folder. Now, move to Recovered Data folder and press Y to copy the deleted item to it.
The time it takes to fully recover the data depends upon the size of selected file/folder. When done, you will see Copy done! message above the list of deleted files. Similarly, you can selectively recover deleted files and folders from primary hard disks and removable drives.
Like TestDisk, the Foremost console application supports a number of file systems including EXT3, NTFS and FAT. The application was specifically designed to recover data from image of the drive. It’s recommended to first create a directory in disk where recovered files are to be stored; mount the disk and navigate to location where you want to create a folder using following commands in Terminal.
cd <disk identifier of volume>
sudo mkdir <folder name>
Once created, enter following command to begin recovering data from specified disk to newly created folder.
sudo foremost – i /dev/<identifier of disk which is to be recovered> –o /<folder name>
The standard procedure for recovering data through foremost includes –i and –o switches, which recover all the data on the specified disk to defined folder. However, if you want to specify the types of files that are to be covered, you can use –t switch. The syntax of foremost command with –t switch is as follows.
sudo foremost –t <file extension> –I/dev/<identifier of disk which is to be recovered> –o /<folder name>
Using Hiren’s Boot CD
Hiren’s Boot CD includes all the essentials tools and system formatting utilities to help you fix numerous types of PC issues, including corrupt boot sector, hard disk boot problems, invalid/corrupt Master Boot Record, registry discrepancies and more. Since it’s a Boot CD, it doesn’t require you to boot up the system with installed OS, and use the included system diagnostics packages. All you need is to burn the Hiren’s Boot CD ISO image to disc to run system performance and diagnostic utilities in an isolated and completely independent environment. To get started, download Hiren’s Boot CD ISO image (link given at the bottom of the post). Now, right-click Hiren’s Boot CD image file and select Burn disc image.
This will open Windows native Disc Image Burner. Now all you need is to burn ISO to disc to specify the CD Drive and then click Burn. Once the image is burned to disc, reboot your system into BIOS menu by pressing system defined key at system startup. Now, move to boot menu and set CD/DVD ROM as first boot menu. Once changed, reboot your system to access Hiren’s Boot CD system diagnostics menu.
If the hard disk has bad sectors, you need to run HDAT2 to identify and repair bad sectors. You will find all the hard disk related issues under Dos Programs –> Hard Disk Tools.
As mentioned earlier, Boot Hiren’s CD includes recovery tools namely TestDisk and PhotoRec. You will find these tools in Dos Programs –>Recovery Tools menu.
The PhotoRec is quite similar to TestDisk as far as usage is concerned. It’s considered as one of the most powerful data recovery application, as it ignores file system and starts searching the lost data (video images, archive containers etc). According to PhotoRec developer, it can recover data even if your media is severely damaged or formatted. It also searches for disk partitions, and lets you recover files from both only free unallocated space and full (free+used) disk space.
Since Hiren’s Boot Image in loaded from CD/DVD, the TestDisk will relatively take more time in searching, analyzing and recovering data, than running with Ubuntu Live Disk.
Note: You should specify remote directory or external hard disk as output location for saving recovered data, as attempting to recover data on the same disk where it’s being read from may lead to permanent loss of data, and in some cases, unrepairable bad sectors.