+3 votes
203 views
Recover data from a Windows Hard Drive with Live CD Linux

in Linux / Unix by (551k points)
reopened | 203 views

1 Answer

+4 votes
Best answer

An interesting option is the Ubuntu livecd that has the options that is to test or install Ubuntu.

image

We are going to test Ubuntu and the operating system will start all completely in memory and although it is not a physical installation it also recognizes all the hardware devices and therefore also the hard drives and partitions that we have.

If we enter the file system and browse the directories or partitions that we have, we will find that some directory has the windows file.

As Linux is fully functional then we can use some of the software that it brings to make a backup of the damaged disk, for example Brasero that is similar to the Nero Express to burn dvd and cd.

Once protected all our data we can try to repair the disk or files because with the Live CD we have other applications available as a problem checker in the disks , Ram, partitions and others that gives you a very complete detail of the operation. We can also install an antivirus such as ClamAV and a malware detector such as Maldetec .

We have the advantage that the Livecd still working in memory only, we can install programs therefore from the terminal window we will install testdisk :

 sudo apt-get install testdisk 
Then we run as root:
 sudo testdisk 
A screen will allow us to select if we want to create a log of the operations that we will perform, add the information to another log or not record the operations that we will do.

image

We give Intro and then allow us to select the partition on which we will perform the test.

image

After selecting the partition, we give Intro and we will be allowed to select the type of partition if you are on PC will be Intel, as we see supports almost all architectures:

image

We give intro and then we have several options to perform tasks on our disk, among which we will only use the first " Advanced "

image

We give Intro and we can see in this case that the partition on which the tasks are executed is FAT32, that is, the main partition is Windows as well as Linux partitions, which indicates that it could be a multiboot, that is, it can start from different operating systems..

image

With the arrows on the keyboard we select the undelete operation (not deleted) to search and recover deleted files and directories .

image

In red you can see the files and directories deleted, we can recover it by pressing the C key that will copy the files in the current directory, that is, where we have run testdisk.

With Testdisk as well as recover files and directories we can perform various tasks as

Testdisk tasks
  • Fix the Table of Partitions, recover deleted partitions.
  • Recover FAT32 boot sectors from your backup.
  • Rebuild boot sectors FAT12 / FAT16 / FAT32.
  • Fix FAT type boot tables.
  • Rebuild NTFS boot sectors.
  • Recover NTFS boot sectors from your backup.
  • You fix the MFT using the MFT mirror.
  • Locate the backup copy Superblock of ext2 / ext3.
  • Recover files from file systems FAT, NTFS and ext2.
  • Copy files from deleted FAT, NTFS and ext2 / ext3 partitions.

by (3.5m points)
edited

Related questions

+3 votes
1 answer
asked Sep 19, 2019 in Linux / Unix by backtothefuture (551k points) | 266 views
+3 votes
1 answer
asked Jun 25, 2020 in iPhone Tutorial by backtothefuture (551k points) | 401 views
+4 votes
1 answer
+3 votes
1 answer
asked Jun 23, 2019 in Linux / Unix by backtothefuture (551k points) | 197 views
Sponsored articles cost $40 per post. You can contact us via Feedback
10,632 questions
10,764 answers
510 comments
3 users