Recovering data is not something every IT professional wants to face. But when the opportunity arises, you will be glad that Linux is there to help you.
Data recovery: The process of saving data from a computer when the home device is said to be inaccessible data.
This is something that IT professionals don’t want to be dealt with, especially in data centers. Why? Because data recovery can mean data loss, and the implications around data loss are many:
- Lost revenue
- Missing documentation
- Lost contact
- Lost property information
- Client information missing
- Lost time
- Lost confidence
This list continues. In the end, when something goes wrong with the system (viruses, failed hardware, damaged or damaged operating system, etc.), you can recover valuable data stored on that local drive. This can be on a desktop or server, end-user machine, or a residential system from your company / web / cloud database.
The truth of the matter is, this is not a “if” problem, but “when” you finally have to recover data. Although the cloud makes this a little less daunting (with the ability to synchronize your data to the cloud server using little effort), you can’t always rely on the cloud and, in some cases, you might have data that you don’t want hosted on third-party servers.
So when you are assigned to recover data, where do you turn to?
For many people, the answer is Linux.
But how does one operating system allow data recovery from other events? You will be surprised how easily this can be done. As long as the hard drive does not fail randomly (at what point you will send the data to a forensic specialist or accept defeat), you can recover that data without too much trouble.
Let me explain.
Welcome to Direct distribution
One area where Linux has been shining for years is the ability to test Linux distributions before they are installed. This is done by what is called direct distribution. The way it works is simple: When you boot the distribution directly (which is mostly modern Linux operating systems) you will see something similar to what Ubuntu has to offer (Figure A).
The Ubuntu Desktop Linux Installer makes it easy to start Live instances.
By clicking Try Ubuntu, you launch an instance directly from the operating system. What does this mean? An instance directly runs completely in the system RAM, so nothing has changed on the machine’s hard drive. In other words, if the machine has Windows installed on a local drive, Windows will still be there, just not running.
This is where everything becomes very helpful.
The immediate example gives you access to all the tools available on the Linux operating system, even though it was installed on the drive. That means you can install directories and copy files.
See where this is? If not, let me explain it.
The process of recovering data using Linux
Say you have a Windows 10 machine that, for whatever reason, will no longer boot. You have tested the hard drive and there is nothing wrong, so the problem is the motherboard or Windows itself.
And there is data that you must have on that internal drive.
To recover that data, you burn a Linux distribution to a flash drive (using a tool like Unetbootin), insert the flash drive in the system in question, and boot from the flash drive. When prompted, click Try Ubuntu (or whatever distribution nomenclature you choose to use). After the instance runs and runs immediately, you must then find the drive in question, which can be found with the command:
sudo sfdisk -l
This command will print a list of all drives installed on the machine (Figure B).
Find the location of the drive that holds data that can be accessed.
As you can see, on Linux, drives are labeled in the form / dev / sdX (where X is the letter). This is where things get a little complicated, especially if you have a lot of drives installed on the machine that can’t be booted. If there is only one drive, chances are it will be labeled / dev / sda. If there is more than one drive, you might have to take the time and install all the drives, until you find the data in question.
To install a drive means that you install the drive into a directory, so that data can be accessed. Let’s do it
First open a terminal window and create a temporary directory with the command:
sudo mkdir /data
With the directory in place, we can install the drive there. Let’s assume the drive is an NTFS file system, found in / dev / sdb. To install this drive into our newly created directory, give commands like:
sudo mount -t ntfs-3g /dev/sdb1 /data -o force
Why 1? Because, most likely, your data is stored on the first partition – unless the drive is partitioned differently. For this, you might have to use a little trial and error, like so:
sudo mount -t ntfs-3g /dev/sdb /data -o force
sudo mount -t ntfs-3g /dev/sdb2 /data -o force
Eventually, you will be able to successfully install the Windows drive, which means that all the data it contains will be found in the newly created directory / data. You can use the command line or file manager to navigate to that directory. You will then see a folder like:
- documents and settings
- Program file
- System Volume Information
What does that have to do with the data?
After you find the folder that holds your data from the Windows drive, you can easily copy it. To do that, plug in another USB drive (let the one carrying the distribution directly available) and click the entry in the left panel of the file manager to install the drive (Figure C).
USB drive in the Nautilus file manager.
Navigate to the folder that holds the data to be copied (say it is named client_data) and right-click the folder in question. Select Copy from the menu (Figure D).
Copy the client_data folder stored in the WINDOWS directory.
After the data has been copied, navigate to the newly installed USB drive in the file manager, right-click somewhere in the right panel, and select Paste (Figure E).
Paste data from an inaccessible drive to a USB drive.
When data insertion is complete, you can then disconnect the USB drive that contains the copied data by clicking on the up-pointing area associated with the drive in the file manager’s left panel.
Congratulations, you have just recovered data from a Windows drive that cannot be accessed using Linux. Copy the data to a working machine and you back up and run it.