Recovering data in Ubuntu Linux. Applied necromancy in Linux or returning deleted files from oblivion Removing ext3 reserve from under Windows

You have to resort to data recovery in case of accidental deletion necessary files, when formatting a file system with the necessary data, when a file system crashes, when for some reason the disk is simply no longer detected by the operating system, or when the storage medium is damaged, as a result of which some files become inaccessible or disappear.

This article provides a list of programs that are in one way or another related to the recovery of files, folders, photos, documents, etc. from storage media. Absolutely all of these programs are free, each of them has open source code.

I divided these programs into four groups:

The division is somewhat arbitrary, since some programs have wide functionality and can be placed in several groups at once.

Programs have their own characteristics: the OS they run on, the methods they use, the types of files they can find, file systems, methods they use, etc. If one of the programs does not produce results, then it makes sense to try another.

All the programs described here run on Linux, some of them are cross-platform and run on other operating systems, such as Windows. This will be noted in the program description.

Typically, deleting a file does not delete its contents, but rather deletes information about the file. Roughly the same thing happens when quick formatting carriers. This is exactly what many file recovery programs do - they find the contents of the file and copy it, this process is called “file recovery”. The space (disk area) occupied by the file is considered unoccupied (not allocated) after deletion and can be overwritten when saving another file. Therefore, it is extremely important not to save new data to the media. If you don't do this, then programs and system processes can do this without your participation. Operating systems continually access the file system. For example, Windows OS accesses its registry several times every second throughout the computer's operation. Many processes that you don't even know about also work with the file system. This leads to quite obvious rules:

• do not write new files to the disk or flash drive from which you want to recover a deleted or missing file;
• Be sure to save the recovered files to another medium and not to the one from which the recovery is being carried out, since these files overwrite the data and the chances of recovering each subsequent file decrease;
• if you are running Linux, then unmount the partition or remount it read-only;
• if this is a system partition, then it is recommended to turn off the computer and work from a Live disk or an image of this partition.

A good practice is not to work with the media directly, but to make an image of it and work with the image file. Thanks to this approach:

• the media can be disconnected from the system, which ensures that no OS processes will access it and write data to it;
• you definitely won’t harm the wearer if you do something wrong;
• If the need to restore files is due to a media malfunction, then intensive work of several programs can aggravate the situation.

Programs for recovering deleted files

This section mainly contains programs that restore separate files and folders.

PhotoRec

PhotoRec is perhaps one of the most user-friendly programs. It runs on various operating systems, including Windows. In Windows OS it can work both in console mode and with graphical interface. Despite its user-friendliness, it is very effective for file recovery. It can even work with media whose file system has crashed.

Detailed instructions for working with PhotoRec (including on Windows): https://zalinux.ru/?p=833

This program is a companion to TestDisk, which could also be considered in this section, since it can also recover files. But the main purpose of TestDisk is to restore file systems, so it will be discussed a little later.

Scalpel

Scalpel is an open source file recovery program using a database of headers and footers. Can recover from disk or device images with raw blocks, headers and footers set by the user. The program is used not only for file recovery, but also for digital forensic research.

Some examples of using Scalpel: https://zalinux.ru/?p=877

extundelete

extundelete is a utility that can recover deleted files from ext3 or ext4 partitions.

Some examples of using extundelete: https://zalinux.ru/?p=877

Foremost

Foremost is a console program for recovering files based on their headers, footers, and internal data structure. This process is commonly referred to as “data scraping.” Foremost can work with image files such as those generated in dd, Safeback, Encase, etc. or directly with disk. Headers and footers can be specified in the config file or you can use switches command line, for precise definition of built-in types. These built-in types look at the data structure of a given file format, allowing for more reliable and faster recovery.

Some examples of using Foremost: https://zalinux.ru/?p=877

ext4magic

ext4magic is a Linux admin tool that can help recover deleted or overwritten files on ext3 and ext4 file systems.

In its work it relies on the file system log.

ext3grep

ext3grep is a tool for examining ext3 file systems for deleted content and the ability to recover it. The program helps to recover deleted files only from ext3 file systems.

scrounge-ntfs

scrounge-ntfs is a utility for rescuing data from damaged NTFS partitions; it writes the resulting files to another working file system. Some information about the damaged partition must be known in advance.

Recoverjpeg

Recoverjpeg - Recovers JFIF (JPEG) photos and MOV video files. Recoverjpeg attempts to identify jpeg images on a file system or from a file system image.

magicrescue

magicrescue - scans a block device and retrieves known file types using magic bytes. It can be used as a utility for recovering deleted files or rescuing data from a damaged disk or partition. Works on any file systems, but on very fragmented file systems the program can only recover the first piece of each file. However, these chunks sometimes reach 50 megabytes.

ddrescue

ddrescue is a data recovery tool. Copies data from one file or block device to another, trying to save the good parts first if there are read errors.

File system recovery programs

TestDisk is an open source program licensed under the GNU General Public License (GPL v2+).

TestDisk is a powerful free data recovery program. It was designed primarily to help recover lost partitions and/or restore bootable disks if the problem is caused by software, viruses, or human error (such as accidentally deleting the Partition Table). It is very easy to restore Partition Tables with TestDisk.

TestDisk can:

• Correct the partition table, restore deleted partitions;
• Restore FAT32 boot sector from backup;
• Rebuild (reconstruct) the FAT12/FAT16/FAT32 boot sector;
• Correct FAT table;
• Rebuild (reconstruct) the NTFS boot sector;
• Restore NTFS boot sector from backup;
• To restore MFT using MFT mirror;
• Define backup SuperBlock ext2/ext3/ext4;
• Restore deleted files on FAT, NTFS and ext2 file systems;
• Copy files from remote FAT, NTFS and ext2/ext3/ext4 partitions.

TestDisk is suitable for both beginners and experts. For those who know little or nothing about data recovery techniques, TestDisk can be used to collect detailed information about non-booting disks which can then be used for further analysis. Those already familiar with such procedures should find TestDisk convenient tool when performing a restore.

TestDisk can run under:

• DOS (real or in Windows 9x, DOS-box)
• Windows (NT4, 2000, XP, 2003, Vista, 2008, Windows 7 (x86 & x64), Windows 10
• Linux
• FreeBSD, NetBSD, OpenBSD
• SunOS
• MacOS X

A detailed description of TestDisk with examples of work: https://kali.tools/?p=2578

gpart

gpart tries to guess what partitions are present on the hard drive. It tries to find a lost, overwritten, or corrupted partition table that still exists on the disk that the operating system cannot access. gpart ignores the master partition table and scans the disk (or disk image) sector by sector for multiple file system/partition types. In its work, it uses file system recognition modules, asking them whether a given sequence of sectors resembles the type of file system or partition.

anyfs-tools

anyfs-tools - unix-way set of tools for restoring and converting file systems.

Tools:

• anyfs-tools provides unix-way a set of tools for recovering and converting file systems.
• build_it reads from the directory recursively information about all file system information nodes using the Linux OS driver (for reading) and saves it in the form of an external information node table.
• anysurrect searches for files on the device based on a known structure various types files. Information about found files is also saved in the form of an external table of information nodes.
• reblock changes the file system block size. reblock, using information from the node table, changes the positions of individual file fragments so that they are aligned to the boundaries of the new block sizes.
• build_e2fs Based on the information provided by the external table of inf.nodes, it builds an ext2fs file system on the device.
• build_xfs Based on the information provided by the external table of inf.nodes, it builds an xfs file system on the device.
• anyconvertfs Converts the device's file system using other utilities from anyfs-tools.
• file system driver anyfs for Linux allows you to mount a device using information from an external inf.node table. In this case, such file operations as deleting and moving files will be available on the mounted file system; creating symbolic and hard links, special files; changing access rights. All these changes are saved when unmounted in the same external node table file and do not affect the device itself.
• anyfuse is a FUSE implementation of anyfs

Programs for data recovery from damaged media

safecopy

safecopy is a tool for recovering data from problematic or damaged media. The program rescues data from sources that have read-write errors. It tries to get as much data from the source as possible, even resorting to device-specific low-level operations where possible.

recoverdm

recoverdm - recovers files from disks with bad sectors.

recuperabit

recuperabit is a tool for forensic file system reconstruction.

Forensic programs with data recovery function

Autopsy

Autopsy is a digital forensics platform and GUI for Sleuth Kit and other digital forensics tools. It is used by law enforcement, military and corporate experts to investigate computer incidents. Regular users can use it, for example, to recover photos from a digital camera memory card.

Autopsy was designed to be intuitive out of the box. Installation is simple and the wizard will guide you through all the steps.

Sleuth Kit

The Sleuth Kit (TSK) is a C library and collection of command line tools that let you explore disk images. The key functionality of TSK is to analyze volumes and file system data on a suspect's computer. The plugin framework allows you to incorporate additional modules for analyzing file contents and build automated systems. The library can be incorporated into a large number of digital forensics tools, and command line tools can be used directly to search for evidence.

Because the tools do not rely on the operating system to work with the file system, deleted and hidden content is shown. The program runs on Windows platforms and Unix.

DFF (Digital Forensics Framework - digital forensic framework)

DFF (Digital Forensics Framework) is an open source forensic computing platform built on top of individual APIs. DFF is designed to replace the aging digital forensic solutions in use today. Created for easy to use and automation, the DFF interface walks the user through the key steps of a digital investigation so it can be used by professionals and non-experts alike to quickly and easily perform digital investigations and respond to incidents.

I think each of us has encountered a problem when, due to a glitch in the firmware of a camera, camera, PDA, smartphone, or simply because of a special device /dev/hands, the card was formatted and the data was deleted. In my time this problem I solved it quite simply, using the Portable version of Ontrack Easy Recovery, but since I have been a user of Linux systems for several years now, using this unlicensed application through wine seemed not entirely kosher, and besides, the thirst for research and adventure required me to find a free native analogue for Linux systems . The research ended before it even began, since the first line in Google search led to recruitment TestDisk utilities, which I will talk about in more detail below.

And so, TestDist consists of two utilities:
testdisk and photorec; Official website of utilities.
Short description:
testdisk is a powerful utility designed to recover deleted partitions and recover mbr boot records after software errors, the actions of some viruses, human errors (for example, when a partition was simply deleted).
Testdisk features:
Fixing the partition table; recovering deleted partitions FAT32 recovery boot sector from backup Rebuilding FAT12/FAT16/FAT32 boot sector Fixing FAT tables
Rebuilding the NTFS boot sector Restoring the NTFS boot sector from a backup Fixing MFT using an MFT mirror Finding ext2/ext3 Backup SuperBlock
Recovering deleted files in FAT, NTFS and ext2 file systems
Copying files from FAT, NTFS and ext2/ext3 remote partitions.

photorec– data recovery utility such as video files, documents, archives with hard drives and cdrom disks, as well as photos (that’s why the name Photo programs Recovery) from the built-in memory of cameras. The list of file types for recovery is very impressive and you can familiarize yourself with it.

Both utilities are open source, distributed under the GNU General Public License (GPL). Versions are available for Linux, Unix, and Windows platforms.

Most Linux distributions are already included in the standard repository. For debian-based distributions, install with the command:

In my case, I needed to recover photos from a camera card after the camera accidentally formatted the card. Having inserted the flash drive into the card reader and launched photorec as root in the console, the utility prompted me to select the disk on which I wanted to restore the data.

In my case it will be /dev/sdb.
Next, select the type of partition table on the disk; for most users it will be Intel/PC.

And then select the entire partition or disk to search for deleted files. Since I needed to recover all deleted files after formatting, I chose to search the entire disk.
After this, photorec is required to indicate the type of file system in which the deleted files were stored. In this case, everything is simple, select the second item.

And then on another drive we select the directory where the utility will save the recovered files.

Next, press Y and the program begins its work. For a 32MB card it took her less than a minute.
Now about the results of the work:
To be honest, at first I was very doubtful about the program’s abilities. But having opened the directory with the results of the utility, I was surprised to find that not only the required 10 recently taken photographs were restored, but also 110 others, the earliest of which was taken 3 years ago and was not overwritten with further use of the card, although it was formatted card repeatedly.
As a result, we have another victory of good over evil, a happy smile from the owner of the camera, another proof that there is a sea of ​​useful and high-quality opensource utilities.

If you have Linux installed on one of your disks and, being booted into Windows, want to view the contents of this disk, it turns out that this is not so simple. You will need to install additional driver and software.

Otherwise, when connecting, for example, a flash drive with Linux, we are greeted with this “happy” message that “To use the disk in the drive, first format it.”

Yesterday's archiver update

Hidden from guests

Before version 15.08 beta gives us the opportunity to simplify this task. 7-Zip now supports extracting ext3 and ext4 images (Linux file system).

My tests gave different results, but the general conclusion is: new feature Works great with different distributions, except CentOS (I don't know why).

Opening ext3 and ext4 file system from Windows

It's quite simple.

Hidden from guests

Version 15.08 or later. If Linux OS is installed on the partition hard drive or to a flash drive, then go to

\. \.PhysicalDrive0

If you need open image from linux, then you work with it as with a regular archive:

If needed view the contents of the virtual hard disk on which Linux is installed, then open this virtual hard disk as an archive, the available partitions are presented in the form of images:

By double clicking you can go inside these images and view/copy data from them:

An important detail - even big rims open very quickly. If the virtual disk is dynamic, then this does not cause any problems.

However, not everything is so rosy.

Opening Kali Linux and CentOS partitions from Windows using 7-Zip

I was not able to look inside the sections of these operating systems.

Instead of opening, 7-Zip tried to extract the image files to a temporary folder. This was giving me an out of space error on the C drive. When this error was resolved and I extracted the image file, 7-Zip still failed to open it, giving me the error “The disk image file is corrupt.”

Moving the 7-Zip temporary folder to another location

Since we're talking about the error about the C drive being full when running the 7-Zip archiver, I'll describe here a couple of ways in which it can be solved.

For some reason, the standard directory change setting does not work in the latest beta versions.

1st method to change temporary folder 7-Zip (I liked him better)

Switch to two-panel mode (run 7zFM.exe and press "F9"). Then open the desired archive in the left pane and use "F5" or "Extract" to extract the archive into another pane.

This method worked great for me.

2nd method of changing the temporary directory 7-Zip

Change the environment variable %Temp% to the directory you need. You can do this like this: right-click on This computer, then select Properties. After Extra options systems, select tab Additionally, and select Environment variable.

Select %Temp% from the list and edit it to suit your needs.

All programs that use the temporary directory Temp, will now use the new installed path.

The method, as they say, is not for everyone.

Have you often encountered situations where you needed to recover data? You accidentally deleted the file, but when it was too late you came to your senses, but did not know how to restore it; as an option, you installed the operating system and, out of ignorance of disk layout, formatted the disk with all the data, music, movies, home photos and other other data. You are in despair, not knowing whether it is possible to recover, you have restored everything bit by bit, but this is only the smallest part of solving the consequences of the problem that has arisen, data in Linux can be recovered and for this there are utilities, both paid and free, and today we will discuss 7 utilities that will help with recovery data in Ubuntu Linux.

Partially, of course, all this helped, but most of the data was still lost, and imagine the situation, you are a student, preparing a coursework, there is a week or two left before it is due, and you have a flight. HDD where your coursework was, what to do in this situation.

I know that many users are accustomed to working with a graphical interface from the time they worked on the system, but today we will also discuss console utilities, since many of them help in recovery no worse, and in some situations even better.

How to recover data and what applications to use?

How to recover data using Scalpel utility

Scalpel is a set of tools for fast file recovery. A unique utility, its uniqueness lies in the fact that it does not depend in any way on the file system. The utility searches the database for files of all known formats and tries to find them on the disk using its own specific patterns, looking at the beginning and end of the file. It can help in recovery in such file systems as FATx, NTFS, ext2/3, also from “RAW” partitions.

Let's install the utility, run the command in the terminal:

sudo apt install scalpel

the utility works according to its internal template /etc/scalpel/scalpel.conf, if you want to restore files of a certain format, you should open the config and uncomment the corresponding lines for of this type files. When editing a config template, you need to be very careful not to break it or delete anything unnecessary.

Example of using Scalpel:

sudo scalpel file.iso -o dir_recovery

recovery directory" dir_recovery" must be empty file.iso this is an example of the data that we need to recover, we know that we had such an image with exactly the same name, we can specify not only the file directly, but we can also specify the full path to the device from which we need to restore, like this /dev/sdb1/directory_name/directory_name2/filename.

How to recover data using R-Linux

R-Linux is free program to restore Ext2/Ext3/Ext4 FS file systems used in Linux and some Unix operating systems (OS). Used in R-Linux Scanning technology and an easy-to-set program interface give the user absolute control over the data recovery process. The program recovers data from existing logical drives, even if file records are lost. However, the program does not have the ability to restore data over a network, as well as functionality for reconstructing disk arrays and recovering data from them.

There are two versions of the R-Linux utility: for Linux OS and for Windows OS. They have the same functionality, the only difference is the host OS.

R-Linux recovers the following files:

• Deleted as a result of a virus attack, power failure or system damage;
• From damaged or deleted partitions, after formatting the partition, even to a partition with a different file system;
• When the partition structure on the disk has been changed or damaged. In this case, R-Linux can scan the hard drive, find a previously deleted or damaged partition, and only then recover data from the found partition.
• From hard drives that have big number bad sectors. R-Linux allows you to copy information and create an image of an entire disk or part of it, and only then work with the image file saved on another medium, as with the original disk. This is especially useful and effective when the number of bad sectors on the disk is constantly growing, and the remaining information needs to be saved immediately.

What R-Linux can do:

• Host Operating System (OS):
• Option for Linux OS: any Linux OS based on kernel 2.6+
• Option for Windows OS: Win2000, XP, 2003, Vista, Windows 7, Windows 8/8.1, Windows Server 2008/2012
• Supported file systems: Ext2/Ext3/Ext4 FS (Linux) only.
• Recognition and analysis of Dynamic (Windows 2000/XP/2003/Vista/Win7), Primary, BSD (UNIX) partition schemes and APM (Apple Partition Map) partition schemes. Support for dynamic partitions on GPT as well as on MBR.
• Creating an IMAGE FILE for an entire physical disk, partition or part thereof. Disk image files can be processed by the program as a regular disk. Two types of images are possible: 1) Images that are an exact byte-by-byte copy of the object (Uncompressed images) - such images are compatible with previous versions R-Linux; 2) Compressed images - can be compressed, split into multiple files and password protected. Such images are fully compatible with images created by the R-Drive Image program, but are incompatible with previous versions of R-Linux.
• Recovered files can be saved to any drive, including a network drive, accessible by the local operating system.
• Monitoring S.M.A.R.T parameters R-Linux can display S.M.A.R.T parameters. (Self-Monitoring, Analysis and Reporting Technology) for hard drives that show the state of their hardware and predict their possible failures. Any additional load on such disks should be avoided if warnings from the S.M.A.R.T system appear.
• Search for deleted versions of files. R-Linux can search for deleted versions of files using their sizes, names, extensions and recognized file types as search parameters.

If there is something you don’t understand about the application, you can read the reference manual using the links / the manual is quite extensive, you will find answers to many questions.

How to install R-Linux

You can download the file for your architecture from the link - then to install, open a terminal and run the commands:

Cd ~/Downloads/ cd ~/Downloads/ sudo dpkg -i rli*

after installation is complete, look for the application in Ubuntu menu - System utilities - R-Linux, after the first launch you will see an English-language application, do not be alarmed, “Russian” support is also present. Go to Help menu - Interface Language, and select Russian, done.

If you need to restore files, connect a flash drive as an example, you see that the flash drive is detected, on the Ubuntu sidebar, click the update button in the application to see your media. Next, select a section of our flash drive with the mouse cursor and press the button " Scan".

As you can see, we are offered to configure the scanning parameters in more detail, whether to search by known file types, whether to keep a log, where specifically to search, we are allowed to specify from which segment of bytes the scanning should begin, from 0 according to the standard, or to specify your own data.

The scanning has started, we wait until it is completed, we do not cancel it in any case, sometimes this can end badly for the flash drive. The scanning is completed, then we see the following picture:

Below under our flash section there is an area called " Found by signatures", click on this section with the mouse cursor and we will see a new window:

click on the line " Files found based on information about typical features of their data structure". After clicking on this link we will see something like the following:

Select the directories you need and press the button " Restore marked", I checked for the sake of a test, the utility works well, try it and report back based on the results of how it works in a real situation when data is lost, files are deleted, etc.

How to recover data using the R-Studio utility

It's a paid utility, but it's worth it because it will help out even the most difficult situations, you can buy on the official website -. An advanced utility, the best among data recovery utilities, works with file systems NTFS, NTFS5, ReFS, FAT12/16/32, exFAT, HFS/HFS+ (Macintosh), Little and Big Endian variants of UFS1/UFS2 (FreeBSD/OpenBSD/NetBSD /Solaris) and Ext2/Ext3/Ext4 FS (Linux). R-Studio also uses signature-based file recovery (scanning search for known file types) for severely damaged or unknown file systems. The program allows you to recover data both locally and on remote computers over a network, even if disk partitions have been formatted, damaged or deleted.

R-Studio includes:

• RAID reconstruction module
• Universal text/hexadecimal editor with a wide range of capabilities
• Separate module Reserve copy system and data (disk copying), which allows us to consider R-Studio the most optimal and complete solution when creating workstation for data recovery.

R-Studio recovers files:

• Deleted outside the Recycle Bin or when the Recycle Bin was emptied;
• Deleted virus attack or computer power failure;
• After the partition with the files has been reformatted, even to a partition with a different file system;
• When the partition structure on the hard drive has been changed or damaged. In this case, using the R-Studio program, you can scan your hard drive, find a deleted or damaged partition, and only then recover data from the found partition.
• From hard drives that have a large number of bad sectors. The R-Studio recovery program can first copy information and create an image of the whole disk or part of it, and only then work with the image file saved on another medium as with the original disk. This is especially useful and effective when the number of bad sectors on the disk is constantly growing, and the remaining information needs to be saved immediately.
• By Order of the Ministry of Justice of the Russian Federation dated November 26, 2015 No. 269, R-STUDIO was included in the list of requirements for the minimum configuration of the material and technical base for several types of forensic examinations carried out in federal budgetary forensic institutions of the Ministry of Justice of the Russian Federation.

What the R-Studio utility can do:

• Standard Windows Explorer user interface.
• Host operating system (OS): Windows 2000, XP, 2003 Server, Vista, 2008 Server, Windows 7, Windows 8/8.1/10, Windows Server 2012.
• Data recovery over the Internet. Files can be recovered over the network from remote computers running Win2000/XP/2003/Vista/2008/Windows 7/8/8.1/10/Windows Server 2012, Macintosh, Linux and UNIX.
• Supported file systems: FAT12, FAT16, FAT32, exFAT, NTFS, NTFS5, ReFS (the new local file system introduced by Microsoft in Windows 2012 Server), HFS/HFS+ (Macintosh), Little and Big Endian variants of UFS1/UFS2 (FreeBSD /OpenBSD/NetBSD/Solaris) and Ext2/Ext3/Ext4 FS (Linux).
• Search when Scanning Files of Known Types (file recovery by signatures): if the file system on the disk is severely damaged or unknown, then R-Studio searches for data patterns (file signatures) characteristic of certain file types (documents Microsoft Office, jpgs, etc.). If necessary, the user can add new file types to R-Studio.
• Recognition and analysis of Main (MBR), GPT and BSD (UNIX) partition schemes, as well as Apple partition schemes. Support for Dynamic Volumes (Windows 2000-2012/8.1/10) on MBR and GPT.
• Windows Storage Spaces support (Windows 8/8.1 and 10/Threshold 2), Apple software RAID and Linux Logical Volume Manager (LVM/LVM2). R-Studio can automatically recognize and collect the components of these disk managers even if their databases are slightly damaged. Their components with seriously damaged databases can be added manually.
• Reconstruction of damaged disk arrays (RAID). If the OS does not recognize the disk array (RAID), you can create a virtual RAID from its components. Such a virtual array can be processed by the program as a regular physical one. Supports standard RAID levels: 0, 1, 4, 5, 6. Supports nested and non-standard levels: 10(1+0), 1E, 5E, 5EE, 6E. Parity delay support for all relevant RAID levels. Support for custom RAID schemes.
• Automatic recognition of RAID parameters.R-Studio is able to recognize all parameters for RAID 5 and 6. This allows the user to solve one of the most difficult tasks in RAID recovery - determining its parameters.
• Creating an IMAGE FILE for the whole Physical Disk(HD), Section or part thereof. Such image files can be compressed and split into several files for saving on CD/DVD/Flash or FAT16/FAT32/exFAT. Disk image files can be processed by the program as a regular disk.
• Recovering data from damaged or deleted partitions, encrypted files (NTFS 5), alternative data streams (NTFS, NTFS 5).
• Data recovery after:
• launching FDISK or similar utilities;
• Virus attack; FAT damage; MBR destruction.
• Localized name recognition.
• Recovered files can be saved to any drive, including a network drive, accessible by the local operating system. Recovered files can be saved on another connected drive remote computer without downloading over the network to the local computer.
• View file contents to assess recovery chances. The contents of most file types (formats) can be viewed even if the application corresponding to the file is not installed.
• Files or disk contents can be viewed and edited using the built-in hex editor. The editor supports editing properties of NTFS files.
• Monitoring S.M.A.R.T. parameters R-Studio can display S.M.A.R.T. parameters. (Self-Monitoring, Analysis and Reporting Technology) for hard drives that show the state of their hardware and predict their possible failures. Any additional load on such disks should be avoided if warnings from the S.M.A.R.T system appear.
• Integration with DeepSpar Disk Imager - a professional hard drive imaging device specifically designed for data recovery from failed drives. This integration provides low-level, thin access to drives with a certain level of hardware failure. Moreover, it allows you to create a disk image and perform analysis at the same time. That is, any sector accessed by R-Studio on the source disk will be immediately copied to the clone disk, and all subsequent data recovery operations will be performed on the clone disk to prevent further deterioration of the source disk and significantly reduce the time processing.

Of course, not all utilities for data recovery are described above, there is also a list of such utilities as Unrm, Giis, Ddrescue, DMDE, PhotoRec, Mondo Rescue and Safecopy, I described only the main ones, about other utilities and their capabilities, I would advise you to familiarize yourself with the material - . This is probably the end of the material, there will be questions, ask, clarify and leave feedback about the utilities you used that you recovered data, maybe the article doesn’t contain what you use, describe in the comments what you use.

How in Windows environment make it possible to access a disk partition or removable media with file systems Ext2/3/4 ? If, for example, there is also a second system on the computer Linux. And you need to work with its data from the environment Windows. Or another example - when virtual disks are mounted inside Windows with installed virtual machines systems Linux or Android. With Ext2/3/ 4 Windows cannot work natively; it needs third-party tools for this. What kind of means are these? Let's look at those below.

***
The first three tools will make it possible to only read information devices from Ext2/3/4. The latest solution will allow you to both read and write data. All the tools discussed below are free.

1. DiskInternals Linux Reader

A simple program is a primitive file manager, made like a standard one. Windows Explorer, with file system support Ext 2/3/4 , Reiser4 , HFS , UFS2. In the program window we will see partitions and devices with Linux or Android.

To copy, you need to select a folder or file, press the button "Save".

Then specify the copy path.

2. Plugin for Total Commander DiskInternals Reader

Fans of the popular can extract data Linux or Android inside Windows using this file manager. But first install a special plugin in it. One of these plugins is , it can connect and read information devices formatted in Ext2/3/4 , Fat/exFAT , HFS/HFS+ , ReiserFS. Download the plugin, unpack its archive inside , confirm the installation.

Let's launch (important) on behalf of the administrator. Let's go to the section. Click.

Here, along with other disk partitions and media, the one with Ext2/3/4 .

Data is copied traditionally way - by pressing F5 on the second panel.

3. Plugin for Total Commander ext4tc

A simplified alternative to the previous solution - ext4tc, another plugin for . It can connect to read information devices formatted only in Ext2/3/4. Download the plugin, unpack its archive inside the file manager, and start the installation.

Let's launch (important) on behalf of the administrator. Click. Let's go to .

If you need to copy data, use the usual method with the F5 key.

4. Ext2Fsd support driver

Program Ext2Fsd– this is the driver Ext2/3/4, it implements support for these file systems at the level operating system. You can work with disk partitions and drives formatted in these file systems as with regular, supported ones. Windows devices information in the Explorer window or third party programs. The driver allows you to both read and write data.

Download the latest current version Ext2Fsd.

During installation we activate (if for long-term work) three suggested checkboxes:

1 — Driver autorun with Windows;
2 - Recording support for Ext2;
3 - Formatting support for Ext3.

At the pre-finishing stage, we activate the option to launch the driver manager window - - along with assigning information to devices from Ext2/3/4 drive letters.

In the window that opens We will see the media with the letter already assigned. For example, in our case, a carrier with Ext4 the first free letter is given F.

Now we can work with the disk F in the Explorer window.

Assign a letter to new connected devices with Ext2/3/4 possible using context menu called on each of those displayed in the window devices. But simply by assigning a drive letter, such a device will not appear after reboot Windows, this solution is only for one computer session. To make a new device with Ext2/3/4 permanently visible in the Windows environment, you need to double-click on it to open the configuration window and install constant parameters connections. In the second column you need:

For removable media activate the checkbox indicated by number 1 in the screenshot and specify the drive letter;
For internal disks and partitions, activate the checkbox indicated in the screenshot below with the number 2, and also indicate the drive letter.