Recovering Lost Data On Linux Or Unix Using The Coroner’s Toolkit (TCT)

Written By
Web Webster
Web Webster
May 19, 2009

[ Thanks to Mike
Golvach
for this link. ]

“1. unrm: This command basically creates one gigantic
file composed of all the free blocks on the partition you want to
do your data recovery from (not to be confused with the partition
on which you lost your data).

“2. lazarus: This command takes the output of unrm and breaks it
up into files (by block), which can make it simpler for you to find
your lost data and restore it.

“It’s recommended, when using unrm, that you mount the partition
from which you want to recover data, in read-only mode. If this is
impossible, that’s not a big deal. It’s imperative that you create
your unrm recovery file on a “different” partition than the one
from which you will be recovering. You will also need to make sure
that this separate partition has about 220% of the free space
available on the partition from which you want to recover,
available for use.

“The breakdown on the 220% worth of disk space is pretty simple.
On your recovery partition, you’ll need 100% of the available free
space on the partition from which you want to recover your lost
data, just to copy all those free blocks over. Makes sense. Now,
the other 120% is, actually, optional and dependant on whether you
make use of lazarus or not.”


Complete Story

Web Webster

Web Webster

Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.

Linux Today Logo

LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.

Property of TechnologyAdvice. © 2026 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.