Recovering Lost Data On Linux Or Unix Using The Coroner's Toolkit (TCT)

[ Thanks to Mike Golvach for this link. ]

"1. unrm: This command basically creates one gigantic file composed of all the free blocks on the partition you want to do your data recovery from (not to be confused with the partition on which you lost your data).

"2. lazarus: This command takes the output of unrm and breaks it up into files (by block), which can make it simpler for you to find your lost data and restore it.

"It's recommended, when using unrm, that you mount the partition from which you want to recover data, in read-only mode. If this is impossible, that's not a big deal. It's imperative that you create your unrm recovery file on a "different" partition than the one from which you will be recovering. You will also need to make sure that this separate partition has about 220% of the free space available on the partition from which you want to recover, available for use.

"The breakdown on the 220% worth of disk space is pretty simple. On your recovery partition, you'll need 100% of the available free space on the partition from which you want to recover your lost data, just to copy all those free blocks over. Makes sense. Now, the other 120% is, actually, optional and dependant on whether you make use of lazarus or not."

Complete Story

Related Stories:

• Undeleted: Carving Tools Help You Recover Deleted Files(Jul 24, 2008)
• Computer Forensics: Linux Style!(Oct 15, 2007)
• Tectonic: Cyber Sleuths Using Open Source to Track Criminals(Feb 21, 2006)
• Computerworld Singapore: Doing Data Forensics Right with Linux(Aug 24, 2005)
• Linux Magazine: The Coroner’s Toolkit(May 05, 2005)