Debian recovery of deleted files. Recovering data in Ubuntu Linux

Troubles happen more often than we would like. One of them is deleting a file with important data. Moreover, in Unix, it is believed that it goes into oblivion. Unfortunately, indeed, restoration deleted files On Unix, this task is not as simple as on Windows, with its familiar recycle bin for deleted files and numerous third-party utilities (for example, Norton Utilities). This is due to the peculiarities of the file system architecture
Unix. Linux OS interprets the concept of a file more broadly. A file is any object that has a name in the file system. One such object is a directory. The directory stores both the file name and Additional Information about the file - its size, information about the file owner, location on disk, creation date, last modification date, access rights and much more. Moreover, for efficiency, additional information is placed in a special structure, and only a link to this structure is left in the catalog. When a file is deleted, this additional information is not physically removed from the disk, but is only marked as free corresponding blocks. Therefore, there is a potential possibility of recovering a deleted file while nothing was written to its location. I will try to propose an algorithm for action when such a problem occurs.

Termination further work.

Immediately after you realize that something terrible has happened, stop further work on the partition of the disk with the deleted file. Naturally, not only you, but also all other users logged into the system should stop working. Take measures so that no one else can log into the system while you are restoring the file (for example, using /etc/nologin). The main thing is to prevent other processes from overwriting disk blocks previously used by the deleted file. The likelihood of this increases significantly if the partition is almost full.

I am my own necrophiliac.

Let's consider two recovery options. One is quite universal, most likely applicable in any Unix system. The second one is designed to work with the Ext2 file system
Linux.

Recovering files with known content

* create a copy of the root partition and place it in a file from the /export section. This section should have enough free space to contain the entire partition on which the file was deleted

# df -k//export
File system Kbytes used available capacity Mounted on
/dev/dsk/c0t3d0s0 122070 19512 102558 16% /
/dev/dsk/c1t0d0s0 17592638 14425963 3166675 82% /export
# dd if=/dev/dsk/c0t3d0s0 of=/export/recover.dsk
263077+0 records in
263077+0 records out
# ls -l
-rw-r-r-- 1 root other 134701056 Jul 1 16:54 recover.dsk

* run the cat command with the -n switch (output line numbers), the output of which is redirected to the fgrep utility, which, after searching for a given pattern, will cut off all unnecessary

# cat -n recover.dsk | fgrep "root:x:0:1"
200601 root:x:0:1:Super-User:/:/sbin/sh
202108 root:x:0:1:Super-User:/:/sbin/sh

lines may not be found either in case of an error when specifying the template, or in case of loss of the contents of a remote file that could have been overwritten. In our case, as we see, two versions of the file have been saved.

* print a certain number of lines after the found one
# fgrep -A10 "root:x:0:1" recover.dsk > passwd
#cat passwd
root:x:0:1:Super-User:/:/sbin/sh
daemon:x:1:1::/:
bin:x:2:2::/usr/bin:
...

keys -A<число строк>and -B<число строк>The fgrep utilities allow you to display several lines located after (after) and before (before) the line found by the pattern. If you can get your entire file in one step, then you are very lucky. But, unfortunately, files are usually fragmented, and the larger the file size, the higher the likelihood of fragmentation and the larger the fragments themselves. Therefore, most likely, you will have to repeat the described procedure, using different templates and combining the resulting parts. It can be difficult to understand which version of the file saved on the disk is the latest. This can only be determined by viewing the contents of the recovered file. This means you will have to restore all versions of the file. Quite tedious, but effective.

File recovery in Linux Ext2

This method is used in case of deletion with the rm command or the unlink function and does not require knowledge of the contents of the deleted file when restoring. To work, we need the file system debugger debugfs, a fairly powerful utility that is usually used to check and change the file system and provides direct access to the file system. We need three of its commands:

• lsdel - Lists all deleted inodes on a given filesystem
• cat - view the contents corresponding to the handle
• dump - file recovery

Launch debugfs in the required section:

At the prompt, enter the command lsdel (a cup of coffee will not hurt, since the system will take time to view the entire section):

debugfs:lsdel
Inode Owner Mode Size Blocks Time deleted
723300 1000 100664 27018 2/ 7 Mon May 20 19:08:17 2002
723301 1000 100444 1671 1/ 7 Tue May 20 19:08:17 2002
. . . . . . . . . . . . . . . . . . . . . . . . . . . .
944887 1037 100600 597 1/ 1 Sun Jan 26 20:05:00 2003
717281 1000 100400 1 1/ 1 Sun Jan 26 20:05:13 2003
327101 1000 100644 15 1/ 1 Sun Jan 26 20:07:06 2003

It is better to immediately redirect the output to a file by entering the command:

#echo lsdel | debugfs /dev/hda6 > /tmp/lsdel-output

If there have been no operations with the partition since the deletion, then the data we are interested in will be at the end of the list. Let's look at the content corresponding to the last descriptor by typing the command:

debugfs:cat<327101>
my_very_important_data

The deleted file was found, it contained a single line. The dump command restores a file by writing it to disk under the name
my_recovered_file:

debugfs: dump -p<327101>/tmp/my_recovered_file

the -p switch indicates that the file should remain the same owner, group and access rights.

Recovering a group of files in Linux Ext2

To restore a group of files, it is advisable to use Tom Pike's utility
. Installation is standard:

# tar zxf recover-1.3.tar.gz
# cd recover-1.3
# make
# make install

By default, the utility is installed in the directory system with the root /usr. If you need to install it in another location, read the ReadMe. While recover is running, asking a few simple questions, such as who owns the files, when these files were deleted, what the approximate size of these files is, starts debugfs, and restores inodes that match the given criteria, placing them in the directory specified by the user. Unfortunately, file names cannot be restored. Recovered files are named with a dump prefix followed by an inode number.

What have we restored?

To identify recovered files, we use two utilities strings and file. The first displays a sequence of ASCII characters, extracting it from the specified file, the second - finds out the type of file (for example, is it an archive or, say, a file
PostScript).

Run the file utility:

#file*
dump39788: directory
dump98008: PGP armored text signed message
dump80154: gzip compressed data, deflated, last modified: Sun Jan 28 03:31:21 2001, os: Unix
dump73290: ASCII text
dump67095: ?diff? output text
dump72945: JPEG file
dump9773: MPEG 1.0 layer 3 audio stream data, 128 kBit/s
dump8176: ASCII C program text
dump58764: Bourne shell script text executable
dump3223: troff or preprocessor input text

You can automate the process somewhat by using simple scripts like the following, which add an extension to text files of C programs:

# for i in ?file * | grep? ASCII C program text? | \awk -F: ?(print $1)??;
do mv $i $i.c; done

After determining the file type, we will try to identify each file. For those that contain text, C code, sound or image, you can open the appropriate programs and try to guess the original name. Binary files, e.g. executable files, libraries or database files are much more difficult to identify. And if it’s easier not to identify executable files or libraries, but to simply reinstall the missing ones, then you’ll have to tinker with the databases. In this case, you will have to use the strings utility, displaying all the ASCII text strings contained in the file.

# strings dump44768

From the conclusion one can guess that this file is a database and open it with the appropriate program.

Conclusion

Remember, there is no substitute for regular reservations. And the use of the methods discussed in the article should be the exception rather than the rule. Believe me, there is little pleasure in descending into the abyss of oblivion.

Recovering deleted data is possible as long as you do not overwrite other information in its place. This is true for any media, so in Mint and other builds of Linux or Windows, the return of erased files is carried out according to the same scheme, only the tools differ. Below you will find instructions for working with some programs that are excellent at recovering deleted data on Linux.

Recovery via Photorec

The utility, as the name suggests, was created specifically for searching deleted photos. However, over time, the application has turned into a powerful program that finds and returns files of various formats from oblivion. The only condition for successful recovery of deleted data is that nothing should be written in its place. Therefore, immediately after files disappear, you must stop working with the disk from which they were deleted. Copying new files, changing the password - you don’t need to do any of this.

The Photorec program is distributed free of charge as part of the TestDisk package and does not require a registration key. To install it on Linux Mint or other version, open a terminal and run the command “sudo apt-get install testdisk”. To run the program, use the "sudo photorec" command.

1. After starting the application to recover files deleted from the system, enter the user password set on Linux Mint. By entering the password, you will see all the connected drives that are identified in the system. If there is no password, then you do not need to enter anything; the connected media will be displayed immediately. Using the arrow keys on your keyboard, select the partition where the erased data was stored and press Enter.
   
2. In the next window, you can immediately start a search or slightly customize the criteria by filtering out files that do not need to be restored. If you immediately start searching for data deleted from your system, you will spend a long time sorting through file “garbage.” Photorec can find something that the user has long forgotten about, so it is better to limit the program a little. Highlight File Opt (use the right arrow to move) and press Enter.
   
3. By default, all file types are selected. But in order not to overload the system with unnecessary work, uncheck all the marks by pressing the “S” key. Then use the arrows to highlight the data formats that need to be restored and press the space bar to check the box.
   
4. Then return to the previous window. Select the FAT32 format and start the search with the “Search” button.
   
5. Leave the selection on “Other”.
   
6. Select data search mode. If you select "Free", Photorec will only search for deleted files in empty space. If you select the “Whole” mode, the program will scan the entire surface, which will make it possible to recover files that were deleted from the system so long ago that the user forgot about them.
   
7. The last step is to select the directory in which the data found by the program will be saved. To start scanning, press the “C” key in the English layout.
   

The main rule of recovery is to never save files to the partition from which they were deleted. Better use removable media, when the recovery is complete, simply transfer the data back to the system. All the data that Photorec can find and recover will be located in the folder that you specified in the last step. The file names will change, so you will have to spend some time parsing the data, but this is not as critical as losing important information.

An operation such as recovering deleted files in Linux is rarely required. But in order not to be left without important data at the wrong moment, you should be prepared in advance and be able to quickly take the necessary measures.

Recovering deleted Linux files

There are 2 options for data recovery in a Linux system - directly from hard drive system and from a flash drive.

Linux Hard Drive Data Recovery

File systems used in all operating systems, not just Unix-like ones, are organized in such a way that they do not allow a deleted file to disappear without a trace. That is, if a file was created and located on the hard drive, it means that it occupied some space and was included in the list of links among other objects.

When the user deletes it, the link to the file is deactivated, signaling to the file system that the occupied space can be marked as permanent. In fact, the deleted object still exists and is located on the clusters on which it was. Its complete erasure will occur only after its trace is overwritten with other data.

From which it follows that as long as the space where the file was located is untouched, it can be restored. Accordingly, after detecting data loss, you need to immediately stop all recording processes (downloading files, creating documents, updating the system and programs, installing software) and start restoring it.

Recovering data from a Linux flash drive

Since the Recycle Bin works slightly differently in Linux than in Windows, the first thing you should do is test it. Files deleted using the usual method, without emptying the recycle bin afterwards, are stored there. To restore, just connect the drive, go to the trash and restore the object.

But if the data is erased from both sources, you will have to resort to built-in or third-party software recovery. Before doing this, it is recommended to do backup copy the partition on which the file was located. To do this, you must follow the instructions below, with the caveat that to create a copy you need an amount of free hard disk space equal to the capacity of the flash drive. If attempts to restore data on the drive itself fail, you can contact a more experienced technician, providing him with a virtual copy of the partition.

File recovery programs for Linux

The simplest and most obvious way out is to go to a specialized data recovery service. But there is a huge disadvantage - the price. The extraction procedure is very expensive, and no one will tell how difficult this process was. There is also no guarantee for the return of all objects, especially since equipment that can restore a file after several overwrites is supplied only to special services. So, before you despair, you should try to carry out the operation on your own.

Recovering Linux Files with GParted

The most common program for working with partitions in Linux. However, not all distributions come with it. Not the most reliable assistant in such operations, but it’s worth trying as an option.

Recovering files with Scalpel

Scalpel Linux is a small tool that specializes in recovering deleted files from EXT4 partitions and other file systems. It has in its arsenal a database of file system types and data formats, which makes it universal. After all, during scanning, it checks the remaining records on the hard drive or flash drive with its own list, and if a match is found, it begins to restore the deleted Linux files.

Installation and use are simple:

The process can be seen more clearly here:

Recovering Ubuntu Data with TestDisk

TestDisk can also help you recover files from Linux, but in a slightly different way. The fact is that this software is not aimed at extracting data from drives, but at testing and restoring the functionality of the partitions created on them.

There is also a program in Ubuntu - PhotoRec. First of all, its functionality is designed for restoring multimedia files and archives. This software completely ignores errors, missing or formatted file systems, thereby scanning data without any problems.

Now it comes with TestDisk, and because of this combination of efforts, the final utility is considered the best among recovery programs Ubuntu files. To avoid problems due to user inexperience, during basic settings and manipulations, the utility uses the “everything in the system is read-only” approach.

By identifying information errors, TestDisk can recreate lost partitions in various file systems, such as FAT, NTFS and EXT4. Even if the partition was previously deleted, by finding traces of it, the program will be able to fix dependencies that prevent the file from being accessed correctly. The program is available in the official Canonical repository. In order to start recovering data from an Ubuntu hard drive, you need to follow the instructions:

Linux data recovery with Safecopy

Safecopy is a simple tool for interacting with partitions and data. It does not help in recovering data from an Ubuntu flash drive, but it will be able to copy objects from damaged media to healthy ones. Its advantage is that it completely ignores errors that occur when reading and copying files. What can best affect your attempt to save multimedia files.

Pair broken byte It will do little to harm a photograph or video, and a text document will most likely just need to be corrected a little. But working with archives, especially if they are password-protected, can be disrupted.

To work with the program you need:

How to delete a file on Ubuntu

There are many ways to delete a file in Ubuntu. But it also all depends on whether it is a system file or a user one. This is easy to understand. Everything before the /home directory is system files, inside it there are custom ones.

Sometimes it happens that we delete, as it would seem not necessary files(images, videos, text documents etc.), and then suddenly we regret it, because... Among the deleted ones, the necessary ones turned out to be. It's good if we delete files in Cart, from where it is very easy to restore by pressing the key combination Ctrl+Z and then all the files that are in Cart will be restored to their previous folders or you can selectively by right-clicking on the desired file in Cart and in context menu - Restore.

But what to do when we deleted files with the function - Delete permanently? Many people believe that the data is lost forever. But that's not true. In this case, the console utility will help us Scalpel.

Scalpel is a simple, highly effective file recovery tool.
Scalpel is a remedy quick recovery files, which reads the beginning and end of files of known formats from the database and tries to find them on disk. The uniqueness of this software is that it does not depend on the file system. Therefore, restoration is possible with both FATx, NTFS, ext2/3, so with "bare" (raw) sections. The tool can be used for both digital search information and for file recovery.

Scalpel available in the repositories of almost all distributions Linux. IN Ubuntu and derivatives you can install it from Application Center or run the command in the terminal to install:

sudo apt-get install scalpel

After installation you will not find it in the system menu Scalpel, because I mentioned above, this tool is launched from the terminal with a specific command. But before you run the command to search for permanently deleted files, you must in the configuration file scalpel.conf uncomment the line (remove the hash sign) with the extension of the desired file (All file types are commented out by default). Run the command in the terminal to open configuration file scalpel.conf:

sudo gedit /etc/scalpel/scalpel.conf

Note. In a team gedit(Ubuntu; Linux Mint Cinnamon) change to name text editor your distribution installed by default.

For example, I chose to search for lost image files with the extension JPG and uncommented this line in the editor that opened with the file scalpel.conf:

You can select any other file. Save the modified file ( Ctrl+S) and close the editor.

And now you need to run a terminal command with the tool
scalpel to find lost files:

sudo scalpel /dev/sda8 -o /home/vladimir /JPG /output/

sda8- this is a partition on the hard disk of my current system. To determine your partition and change it in the command, run the command:

The terminal should display all partitions of the hard drive. As shown in the picture, the mount point of my partition is marked with an arrow, slash or slash - sda8, which I entered into the command. You must have yours marked.

/home/vladimir- that's my name Home folder. Change vladimir on your own.

/JPG- this is the name of the folder in the command that will be created by your Home folder , where all recovered files will be saved, which you can also change to your own.

So, we execute the command and wait for the restoration to complete:

As you can see in the picture, the process of searching and restoring image files with the extension JPG on my computer will happen in two steps, as well as time, depending on the size of the specified partition (GB) and the number of images located on it.
I want to say right away that the process is not fast.

Once the recovery is complete, open Home folder with administrator rights:

sudo nautilus

Instead of nautilus indicate the name file manager your distribution (for example: Linux Mint - nemo or saja; and so on.).

Open the folder with the recovered files, select and save the files you need, and then you can delete the folder permanently, because... it will only take up precious space in the hard disk partition.

Conclusion. I would like to note that the tool scalpel finds all files with the specified extension, even those that were previously on this partition when other operating systems were once installed on it. This utility is also used by intelligence services in different countries to search for compromising information on the user's computer if necessary. So no matter how we delete files permanently, they still leave their mark on the hard disk.

Only physical destruction HDD will save the computer user from compromising files .

Have you often encountered situations where you needed to recover data? You accidentally deleted the file, but when it was too late you came to your senses, but did not know how to restore it; as an option, you installed the operating system and, out of ignorance of disk layout, formatted the disk with all the data, music, movies, home photos and other other data. You are in despair, not knowing whether it is possible to recover, you have restored everything bit by bit, but this is only the smallest part of solving the consequences of the problem that has arisen, data in Linux can be recovered and for this there are utilities, both paid and free, and today we will discuss 7 utilities that will help with recovery data in Ubuntu Linux.

Partially, of course, all this helped, but most of the data was still lost, and imagine the situation, you are a student, preparing a coursework, there is a week or two left before it is due, and you have a flight. HDD where your coursework was, what to do in this situation.

I know that many users are accustomed to working with small-soft systems from the time they worked on the system. graphical interface, but today we will also discuss console utilities, since many of them help in recovery no worse, and in some situations even better.

How to recover data and what applications to use?

How to recover data using Scalpel utility

Scalpel is a set of tools for fast file recovery. A unique utility, its uniqueness lies in the fact that it does not depend in any way on the file system. The utility searches the database for files of all known formats and tries to find them on the disk using its own specific patterns, looking at the beginning and end of the file. It can help in recovery in such file systems as FATx, NTFS, ext2/3, also from “RAW” partitions.

Let's install the utility, run the command in the terminal:

sudo apt install scalpel

the utility works according to its internal template /etc/scalpel/scalpel.conf, if you want to restore files of a certain format, you should open the config and uncomment the corresponding lines for of this type files. When editing a config template, you need to be very careful not to break it or delete anything unnecessary.

Example of using Scalpel:

sudo scalpel file.iso -o dir_recovery

recovery directory" dir_recovery" must be empty file.iso this is an example of the data that we need to recover, we know that we had such an image with exactly the same name, we can specify not only the file directly, but we can also specify the full path to the device from which we need to restore, like this /dev/sdb1/directory_name/directory_name2/filename.

How to recover data using R-Linux

R-Linux is free program to restore Ext2/Ext3/Ext4 FS file systems used in Linux and some Unix operating systems (OS). Used in R-Linux Scanning technology and an easy-to-set program interface give the user absolute control over the data recovery process. The program recovers data from existing logical drives, even if file records are lost. However, the program does not have the ability to restore data over a network, as well as functionality for reconstructing disk arrays and recovering data from them.

There are two options R-Linux utilities: for Linux OS and for Windows OS. They have the same functionality, the only difference is the host OS.

R-Linux recovers the following files:

• Deleted as a result of a virus attack, power failure or system damage;
• From damaged or deleted partitions, after formatting the partition, even to a partition with a different file system;
• When the partition structure on the disk has been changed or damaged. In this case, R-Linux can scan the hard drive, find a previously deleted or damaged partition, and only then recover data from the found partition.
• WITH hard drives, which have a large number of bad sectors. R-Linux allows you to copy information and create an image of an entire disk or part of it, and only then work with an image file saved on another medium, as if original disk. This is especially useful and effective when the number of bad sectors on the disk is constantly growing, and the remaining information needs to be saved immediately.

What R-Linux can do:

• Host Operating System (OS):
• Option for Linux OS: any Linux OS based on kernel 2.6+
• Option for Windows OS: Win2000, XP, 2003, Vista, Windows 7, Windows 8/8.1, Windows Server 2008/2012
• Supported file systems: Ext2/Ext3/Ext4 FS (Linux) only.
• Recognition and analysis of Dynamic (Windows 2000/XP/2003/Vista/Win7), Primary, BSD (UNIX) partition schemes and APM (Apple Partition Map) partition schemes. Support for dynamic partitions on GPT as well as on MBR.
• Creating an IMAGE FILE for an entire physical disk, partition or part thereof. Disk image files can be processed by the program as a regular disk. Two types of images are possible: 1) Images that are an exact byte-by-byte copy of the object (Uncompressed images) - such images are compatible with previous versions R-Linux; 2) Compressed images - can be compressed, split into multiple files and password protected. Such images are fully compatible with the images created by R-Drive program Image, but are not compatible with previous versions of R-Linux.
• Recovered files can be saved to any drive, including a network drive, accessible by the local operating system.
• Monitoring S.M.A.R.T parameters R-Linux can display S.M.A.R.T parameters. (Self-Monitoring, Analysis and Reporting Technology) for hard drives that show the state of their hardware and predict their possible failures. Any additional load on such disks should be avoided if warnings from the S.M.A.R.T system appear.
• Search for deleted versions of files. R-Linux can search deleted versions files using their sizes, names, extensions and recognized file types as search parameters.

If there is something you don’t understand about the application, you can read the reference manual using the links / the manual is quite extensive, you will find answers to many questions.

How to install R-Linux

You can download the file for your architecture from the link - then to install, open a terminal and run the commands:

Cd ~/Downloads/ cd ~/Downloads/ sudo dpkg -i rli*

after installation is complete, look for the application in Ubuntu menu - System utilities - R-Linux, after the first launch you will see an English-language application, do not be alarmed, “Russian” support is also present. Go to Help menu - Interface Language, and select Russian, done.

If you need to restore files, connect a flash drive as an example, you see that the flash drive is detected, on the Ubuntu sidebar, click the update button in the application to see your media. Next, select a section of our flash drive with the mouse cursor and press the button " Scan".

As you can see, we are offered to configure the scanning parameters in more detail, whether to search by known file types, whether to keep a log, where specifically to search, we are allowed to specify from which segment of bytes the scanning should begin, from 0 according to the standard, or to specify your own data.

The scanning has started, we wait until it is completed, we do not cancel it in any case, sometimes this can end badly for the flash drive. The scanning is completed, then we see the following picture:

Below under our flash section there is an area called " Found by signatures", click on this section with the mouse cursor and we will see a new window:

click on the line " Files found based on information about typical features of their data structure". After clicking on this link we will see something like the following:

Select the directories you need and press the button " Restore marked", I checked it for the sake of testing, the utility works well, try it and report back the results of how it works in a real situation when data is lost, files are deleted, etc.

How to recover data using the R-Studio utility

It's a paid utility, but it's worth it because it will help you out of even the most difficult situations. You can buy it on the official website -. Advanced utility, the best among data recovery utilities, works with file NTFS systems, NTFS5, ReFS, FAT12/16/32, exFAT, HFS/HFS+ (Macintosh), Little and Big Endian variants of UFS1/UFS2 (FreeBSD/OpenBSD/NetBSD/Solaris) and Ext2/Ext3/Ext4 FS (Linux). R-Studio also uses signature-based file recovery (scanning search for known file types) for severely damaged or unknown file systems. The program allows you to recover data both locally and on remote computers over a network, even if disk partitions have been formatted, damaged or deleted.

R-Studio includes:

• RAID reconstruction module
• Universal text/hexadecimal editor with a wide range of capabilities
• Separate module Reserve copy system and data (disk copying), which allows us to consider R-Studio the most optimal and complete solution when creating workstation for data recovery.

R-Studio recovers files:

• Deleted outside the Recycle Bin or when the Recycle Bin was emptied;
• Deleted virus attack or computer power failure;
• After the partition with the files has been reformatted, even to a partition with a different file system;
• When the partition structure on the hard drive has been changed or damaged. In this case, using the R-Studio program, you can scan your hard drive, find a deleted or damaged partition, and only then recover data from the found partition.
• From hard drives that have a large number of bad sectors. The R-Studio recovery program can first copy information and create an image of the whole disk or part of it, and only then work with the image file saved on another medium as with the original disk. This is especially useful and effective when the number of bad sectors on the disk is constantly growing, and the remaining information needs to be saved immediately.
• By Order of the Ministry of Justice of the Russian Federation dated November 26, 2015 No. 269, R-STUDIO was included in the list of requirements for the minimum configuration of the material and technical base for several types of forensic examinations carried out in federal budgetary forensic institutions of the Ministry of Justice of the Russian Federation.

What the R-Studio utility can do:

• Standard Windows Explorer user interface.
• Host operating system (OS): Windows 2000, XP, 2003 Server, Vista, 2008 Server, Windows 7, Windows 8/8.1/10, Windows Server 2012.
• Data recovery over the Internet. Files can be recovered over the network from remote computers running Win2000/XP/2003/Vista/2008/Windows 7/8/8.1/10/Windows Server 2012, Macintosh, Linux and UNIX.
• Supported file systems: FAT12, FAT16, FAT32, exFAT, NTFS, NTFS5, ReFS (new local file system, which was introduced by Microsoft in Windows 2012 Server), HFS/HFS+ (Macintosh), Little and Big Endian variants of UFS1/UFS2 (FreeBSD/OpenBSD/NetBSD/Solaris) and Ext2/Ext3/Ext4 FS (Linux).
• Search when Scanning Files of Known Types (file recovery by signatures): if the file system on the disk is severely damaged or unknown, then R-Studio searches for data patterns (file signatures) characteristic of certain file types (documents Microsoft Office, jpgs, etc.). If necessary, the user can add new file types to R-Studio.
• Recognition and analysis of Main (MBR), GPT and BSD (UNIX) partition schemes, as well as Apple partition schemes. Support for Dynamic Volumes (Windows 2000-2012/8.1/10) on MBR and GPT.
• Support for Windows Storage Spaces (Windows 8/8.1 and 10/Threshold 2), Apple software RAID and Linux Logical Volume Manager(LVM/LVM2). R-Studio can automatically recognize and collect the components of these disk managers even if their databases are slightly damaged. Their components with seriously damaged databases can be added manually.
• Reconstruction of damaged disk arrays (RAID). If the OS does not recognize the disk array (RAID), you can create a virtual RAID from its components. Such a virtual array can be processed by the program as a regular physical one. Supports standard RAID levels: 0, 1, 4, 5, 6. Supports nested and non-standard levels: 10(1+0), 1E, 5E, 5EE, 6E. Parity delay support for all relevant RAID levels. Support for custom RAID schemes.
• Automatic recognition of RAID parameters.R-Studio is able to recognize all parameters for RAID 5 and 6. This allows the user to solve one of the most difficult tasks in RAID recovery - determining its parameters.
• Creating an IMAGE FILE for an entire Physical Disk (HD), Partition or part thereof. Such image files can be compressed and split into several files for saving on CD/DVD/Flash or FAT16/FAT32/exFAT. Disk image files can be processed by the program as a regular disk.
• Recovering data from damaged or deleted partitions, encrypted files (NTFS 5), alternative data streams (NTFS, NTFS 5).
• Data recovery after:
• launching FDISK or similar utilities;
• Virus attack; FAT damage; MBR destruction.
• Localized name recognition.
• Recovered files can be saved to any drive, including a network drive, accessible by the local operating system. Recovered files can be saved on another connected drive remote computer without downloading over the network to the local computer.
• View file contents to assess recovery chances. The contents of most file types (formats) can be viewed even if the application corresponding to the file is not installed.
• Files or disk contents can be viewed and edited using the built-in hex editor. The editor supports editing properties of NTFS files.
• Monitoring S.M.A.R.T. parameters R-Studio can display S.M.A.R.T. parameters. (Self-Monitoring, Analysis and Reporting Technology) for hard drives that show the state of their hardware and predict their possible failures. Any additional load on such disks should be avoided if warnings from the S.M.A.R.T system appear.
• Integration with DeepSpar Disk Imager - a professional hard drive imaging device specifically designed for data recovery from failed drives. This integration provides low-level, thin access to drives with a certain level of hardware failure. Moreover, it allows you to create a disk image and perform analysis at the same time. That is, any sector accessed by R-Studio on the source disk will be immediately copied to the clone disk, and all subsequent data recovery operations will be performed on the clone disk to prevent further deterioration of the source disk and significantly reduce the time processing.

Of course, not all utilities for data recovery are described above, there is also a list of such utilities as Unrm, Giis, Ddrescue, DMDE, PhotoRec, Mondo Rescue and Safecopy, I described only the main ones, about other utilities and their capabilities, I would advise you to familiarize yourself with the material - . This is probably the end of the material, there will be questions, ask, clarify and leave feedback about the utilities you used that you recovered data, maybe the article doesn’t contain what you use, describe in the comments what you use.