mranderson17, 1 month ago

So, I’m not sure if the process has changed in the last decade or so but in a long-ago computer forensics class step 0, before all else, was to never operate data recovery on the original disk. Create a block level image of the entire device, then work on that.

My go to steps for recovery have been the following in the years since:

1. create an image of the entire disk (not a partition) using ddrescue ddrescue -d /dev/sdX <path_to_image>.img
2. Run test disk on it selecting the partitions as necessary testdisk <path_to_image>.img

If the disk has a complicated partition layout, or more effort is required to find the correct partition you can also mount parts of the disk.

1. create an image of the entire disk (not a partition) using ddrescue

   ddrescue -d /dev/sdX <path_to_image>.img

2. Mount the image as a loopback device with the appropriate offset

   losetup --offset <some_offset_like_8192> --show -v -r -f -P <path_to_image>.imgthis will mount individual partitions:

   
   <span style="color:#323232;">loop58        7:58   0 465.8G  1 loop
   </span><span style="color:#323232;">├─loop58p1  259:7    0   1.5G  1 part
   </span><span style="color:#323232;">├─loop58p2  259:8    0 450.6G  1 part
   </span><span style="color:#323232;">└─loop58p3  259:9    0  13.7G  1 part
   </span>
   

3. Then operate testdisk on whatever partition you want.

All that said there are a lot of variables here and things don’t always work perfectly. I hope you do find a way to recover them.