Recovering Lost Data On Linux Or Unix Using The Coroner’s Toolkit (TCT)

[ Thanks to Mike
Golvach for this link. ]

“1. unrm: This command basically creates one gigantic
file composed of all the free blocks on the partition you want to
do your data recovery from (not to be confused with the partition
on which you lost your data).

“2. lazarus: This command takes the output of unrm and breaks it
up into files (by block), which can make it simpler for you to find
your lost data and restore it.

“It’s recommended, when using unrm, that you mount the partition
from which you want to recover data, in read-only mode. If this is
impossible, that’s not a big deal. It’s imperative that you create
your unrm recovery file on a “different” partition than the one
from which you will be recovering. You will also need to make sure
that this separate partition has about 220% of the free space
available on the partition from which you want to recover,
available for use.

“The breakdown on the 220% worth of disk space is pretty simple.
On your recovery partition, you’ll need 100% of the available free
space on the partition from which you want to recover your lost
data, just to copy all those free blocks over. Makes sense. Now,
the other 120% is, actually, optional and dependant on whether you
make use of lazarus or not.”

Complete Story