Magic Rescue

The Magic Rescue [7] command-line tool provides another approach to recovering corrupted partition tables or data lost by accidental deletion. However, the software does not rely on filesystem allocation tables; instead, it evaluates the magic numbers that identify each file type. In almost all files, the magic numbers are inserted in the headers before the actual user data and are standardized by the file type.

Corrupt file allocation tables, which no longer allow the reconstruction of individual file fragments, do not negatively affect content recovery. Magic Rescue is included in the repositories for many distributions, such as Debian and Ubuntu, as well as Mageia and openSUSE.

Magic Rescue relies on recipes for detecting the file type. These recipes in file form are used as a template for the software and contain parameters of the respective file types for the command input at the prompt. When you install the software, they end up on the mass storage and accumulate in the recipes subfolder in the /usr/share/magicrescue/ program directory.

The application launches as soon as the user types magicrescue, with an overview of the program options initially displayed. Before starting the actual search, create a target folder with mkdir, in which you store the found data. To reconstruct files on a block device, enter

magicrescue -r Recipe_1 <[...]> -r Recipe_<n> -d <target file> <source>

at the prompt. The -r parameter allows multiple recipe files to be recovered simultaneously in several formats. As a source, you specify a partition (e.g., /dev/sdb1). If you accidentally stipulate a directory or just the name of a block device, the software cancels the reconstruction with an error message.

If the message Command not found appears as a response to a correct command, the application is missing a third-party program that it needs to reconstruct certain file types. This happens especially with JPEG files, for which you need to install the jpeg-progs or libjpeg-progs package from the software repositories. Magic Rescue needs the jpegtran program to save to JPEG image files (Figure 4).

Figure 4: Magic Rescue rescuing an impressive number images that have been long forgotten.

The subsequent reconstruction of selected databases takes quite some time, because Magic Rescue individually searches all sectors of the source partition. Therefore, the program is more suitable for smaller removable disks such as SD memory cards or USB flash drives. The application subsequently stores the recovered files in the target directory, without sorting them.

If you have specified several file types to be reconstructed, the target directory quickly becomes cluttered. Magic Rescue comes with a small command-line tool named magicsort as part of the program package and is used without further parameters. Simply enter magicsort at the prompt in the target directory; the software then sorts the files located in the target directory into their own subdirectories by file type.

R-Studio

One of the most powerful tools for data reconstruction is the commercial R-Studio [8] developed by Canadian R-Tools Technology Inc. R-Studio for Linux is available for around $80 (single-user license) or around $180 in the network variant, R-Studio for Linux Network, from the online store [9]. The manufacturer, who specializes in data recovery and data backup solutions, offers the program as an unlimited demo version for download from the website. However, the maximum size of files you can reconstruct is 256KB – sufficient for simple text files and small images.

R-Studio is available in RPM and DEB package versions for 32- and 64-bit architectures. To convert the demo version into a full version, you just need a license key, which you can purchase online [9].

R-Tools Technology also offers a free full version of R-Linux that doesn't require registration and is specifically for data recovery on ext2, ext3, and ext4 systems. R-Linux is decoupled from R-Studio and offers the same feature scope as the commercial version when reconstructing ext filesystems. However, R-Linux only runs only on single-user systems and does not support other filesystems.

R-Linux and R-Studio both require a 32- or 64-bit machine with 256MB memory and kernel 2.6. To store the reconstructed data, you need to have sufficient free space on the target medium. R-Studio reconstructs image files that can weigh in at several gigabytes. The graphical interface requires a standard Linux desktop.

R-Studio for Linux Network has an agent available for use on the client: The agent comes in 32- and 64-bit versions for Linux systems [10].

R-Studio packages run without problem on all standard Linux distributions that support the RPM or DEB package format.

In addition to the conventional menubar and buttonbar, the program window has three panes. After launch, the top left pane displays all the relevant data on the drives that are connected to the system, as well as the partitions. In the pane on the right, the top level shows device properties or some of the computer's properties (e.g., operating system, kernel version, CPU and RAM data). In the bottom pane, the log lists actions that the software performs during the session; this segment is initially empty.

To scan a storage device and reconstruct the data, first select the desired source partition. Right-click on it and select Open Drive Files to display the contents in the right segment of the program window. A small red cross to the left of the file name or folder symbol represents deleted files and directories that R-Studio can reconstruct. If the folder symbol also displays a red question mark, then it is likely that the contents of the folder in question cannot be reconstructed.

Under the upper left pane, you will find the Extensions, Creation Time, Modification Time, and Access Time tabs (Figure 5). These represent additional sorting criteria for organizing the disk structure.

Figure 5: R-Studio displays recoverable content with small cross symbols.

If you are not sure what file content is hiding behind which name, you can right-click on the file and select Preview – as long as it can be reconstructed – to display the file content. The software will open a small overlay window that displays graphics in their original format. The software plays back video files in multiple formats and also visualizes PDF files.

If you have deleted and overwritten partitions by reformatting a disk, data recovery is not possible using the conventional methods. In this case, R-Studio offers an enhanced reconstruction option (Figure 6). Select the desired drive and either press Scan in the top buttonbar or, after right-clicking, choose the same option from the context menu.

Figure 6: The in-depth scan in R-Studio brings further fragments of old partitions to light.

R-Studio opens a small superimposed window, in which, on request, it defines not only an area to be scanned but also a destination for the scanned file. R-Studio searches the entire disk sector-by-sector for reconstructible data, which can take a considerable amount of time for larger storage media.

If you want to reconstruct data from a RAID system to which direct access is no longer possible (i.e., because the RAID controller has died), R-Studio can stimulate the RAID system using virtual RAID software. However, unlike a conventional RAID system, R-Studio doesn't give you write access.

Foremost

As a command-line-only tool, Foremost [11], which uses a process called data carving, is one of the standard data recovery tools in Linux. The software tries to identify the existing data structures and recover occupied sectors by referencing the metadata, including the header, the footer, and – much like Magic Rescue – the magic number of the file. The program reanimates files up to a size of 2GB. Foremost v1.5.7 is available from the repositories of virtually all the major Linux distributions.

The software is designed to reconstruct numerous data formats out of the box: In addition to various multimedia files, it also recovers some binary and document formats without manual rework. It also recognizes some types of archives. Foremost also lets you integrate new file formats: This is done by editing the /etc/foremost.conf configuration file, which lists the known format types.

After installation, you call the software by entering the program name at the prompt followed by the -t parameter with the file type of the file to be recovered and the source disk, which can be an image or a block device, preceded in both cases by the -i parameter.

Foremost then creates the output folder in the current directory, followed by the file-type-specific subdirectories in which the reconstructed data is stored. Additionally, the software generates an audit file containing information on the disk reconstruction (Figure 7).

Figure 7: Foremost provides detailed information on the disk in an audit file.