Data Recovery

From Jeremy Bryan Smith
Jump to navigation Jump to search

See https://wiki.archlinux.org/index.php/File_recovery

System not booting

MacOS

If a Macbook won't boot MacOS but instead shows a flashing folder graphic with a question mark:

  • Try checking the disk with disk utility (boot with Command-R held down). Try to reboot.
  • Select the disk as the startup disk (boot with option key held down [or from the system menu in newer rescue versions] choose startup disk). Select the system disk and click apply Try to reboot.
  • If the system disk doesn't show up on list of startup disks: Re-write the partition table (and boot sector?) (and EFI partition?) by using the partition editor in disk utility. The apply button will be disabled until a change is made, so temporarily down-size the partition and then set back to the original size and click apply. Try to reboot. Not sure what all this overwrites, but it does the trick. This can probably be done from Linux be re-writing the boot sector (and partition table?) with a known good copy from another machine. I have not tested that.

Windows

Consider this a sign that it is time to switch to Linux.

Failed Drive

If a drive is:

  • Experiencing at least some bad sectors but otherwise seems readable, or
  • You can see that the drive is connected but can't see the partitions or file systems.

Try these tools:

  • ddrescue - Get your data off now while you can still read the disk
  • SpinRite - Aggressively try to re-read bad sectors to move them and thus recover file data

Deleted File

Undelete tools:

Windows

  • Active Undelete
  • Recuva

*nix

  • extundelete
  • photorec