Hard Drive Recovery

A while back, I had to recover as much data as possible from a trashed hard drive. Here are some notes I put together about useful tools:

ddrescue: This copies data off the raw device like dd, but handles I/O errors better, so it can be used to make an image of a damaged device, capturing as much as is readable.

TestDisk: This has a slightly annoying UI but can identify files in an NTFS filesystem that have been deleted and recover them. Because it understands the filesystem, I think it can recover files that are fragmented.

PhotoRec: This program scrapes the raw disk image and spits out anything that looks like a file. This can find stuff even if there aren't pointers to it in the NTFS file index. It will also find tons of junk you don't want. It can't deal with files that are fragmented, but operating systems try to write files contiguously as much as possible, so this can do a pretty good job of digging up things that have been lost.