TestDisk

Data Recovery Options

This documentation is informational not policy.

The purpose of this document is to provide FSP's with the tools necessary to provide the best effort in data recovery should an event occur.
Data recovery documentation will be updated as tools are identified and tested.

Platform: Ubuntu Linux 12.04
Software Tools: TestDisk  link to direct you to a step by step guide for data recovery .
Hardware Tools: USB hard drive adapter or hard drive docking station

This document has 2 parts Preparation & Action

                                          PREPARATION has 3 steps

**Both tools are run from the terminal (command prompt) in Linux**

Prep Step 1



Prep Step 2

**Important step before running ANY data recovery procedure is to assess hard drive functionality**
Before plugging hard drive in, open separate terminal windows and type
tail --f /var/log/syslog press enter.
The below window list information about existing drives attached to system



Prep Step 3

After plugging in the problematic hard drive- the tail --f command used in previous step allows you to see the status of the drive real time as the system tries to identify the hard drive.
**Note**

• The first highlighted section states 'New USB device found'. That's a good sign.
  Device unrecognized or device not found or something to that effect is bad sign and tends to mean no data can be recovered.
  
• The second highlighted section provides hard drive vendor information.
  
• The third highlighted section provides more information regarding the drive

*NOTE* [sdb] in the last line. That can be [sda], [sdb], [sdc] that's useful in the TestDisk steps.
The last letter is assigned randomly as you unplug and plug in the hard drive. For example, the next time it could be [sdc]




                                                                   ACTION has 19 steps

TestDisk
Step 1
Navigate to destination where data is to be recovered to.
In my case I had a 1TB ext. hard drive named SeagateBK for recovered data.

• To navigate to destination location, Syntax is: cd /media/SeagateBK press enter.
• To run TestDisk, Syntax is: sudo testdisk press enter.
• Enter the admin password associated with sudo account you're using and press enter.

Step 2
You will use arrows keys from here on. Using arrow key to select Create and press enter*.*

Step 4
Select the appropriate platform for the hard drive you are recovering from and press enter*. For this document I'm using a PC hard drive, but note the Mac option.*

Step 5
Select Advanced and press enter.

Step 6
Select the appropriate partition to recover data from and choose [List] and press enter. Notice the highlighted 'Size in Sectors'? One partition is the recovery partition and it is smaller.

Step 7
Now we will navigate to the location where the data resides. For the purpose of these instructions, I'm recovering the user's whole document folder. The location of folder is Users/cgoddard/Documents. Select Users and press enter

Step 8
Select cgoddard and press enter

Step 9
Navigate to Documents and press enter.

Step 10
Once inside the Documents folder, press 'a' on the keyboard to select all files.

*NOTE* The other options are 'C' to copy selected file and 'c' to select current file if you are only recovery 1 file.

Step 11
All files will be highlighted in green. Now press 'C' to copy all these files.

*NOTE* The copy options are 'C' to copy selected file and 'c' to select current file if you are only recovery 1 file.

Step 12
Now we need to navigate to destination to copy data that is to be recovered.
Make note of the current directory. We need to get to /media/SeagateBK, SeagateBK being the name of my external hard drive. We need to go backwards in the directory tree. We do that be selecting the line with the '..' as displayed in the image below and press enter.

Step 13
Now we're at /home directory. We need to go backwards once more.
Select the line with the '..' as displayed in the image below and press enter.

Step 14
Now we select media because the USB connected external hard drive will be found here.
Select media and press enter.

Step 15
Select your storage device-in my case it's SeagateBK, and press enter.

Step 16
Navigate to appropriate folder where you want to save data and press 'c'.

Step 17
A message will be displayed notifying you that the copy is in progress.

Step 18
A messaged will be displayed when copying is done.

Step 19
You will now see files that were copied to you storage media.