Linux Essay Example: Data Recovery

Linux Essay: Introduction

Linux has various methods for data recovering including Ddrescue Data Recovery Tool, SafeCopy, Redo Backup and Recovery etc. but one of the most common ones is Scalpel (Top 15 Linux Data Recovery Tools: The Professionals' Choice 2019). This amazing file carver tool primarily founded on Foremost and aims at being prudent in its process. The data recovery tool of Linux makes the best use of asynchronous output/input and multi-threading for searching from end to end images in an effective way (Benthin, n.d.).

Body Paragraphs

Scalpel is one of the good tools for recovering deleted files from the system for one reason or another and forensic analysis. It can be preferred because it is small and fast and also because it is platform-independent (ext2 / 3, Ntfs, Fat). Scalpel looks at the header and footer definitions of the files from a database and performs the recovery process by comparing it from any disk image file or raw disk partition. Since almost all * nix distributions are in package repositories, installation is very simple. Scalpel comes with a configuration file named /etc/scalpel/scalpel.conf where all headers and footer information of all file types that can be recovered are defined. In the same file, information such as maximum file size, whether the header and footer information are case sensitive or not, are set. As an example, the lines of gif and jpg files look like this.

As it is seen, the file extension was specified at first, the letter y is header and footer case sensitive, the maximum size of the files to be recovered (5000000 bytes for gif and 200000000 bytes for jpg). Finally, header and footer information appears. Also, as you have noticed, all the definitions in the scalpel.conf file are commented with (#). Therefore, before starting the recovery process, you need to uncomment-out by removing the pound (#) at the beginning of the definition lines of the file types you want to recover.

After editing the configuration file for you, you can start the recovery process. As an example, the command to recover in Debian's home partition of the system is as follows:

With this command, data recovery will be done for the home directory, and the recovered files will be transferred to the directory named / output. There will also be a log file named audit.txt in the same directory. The contents of the index will be displayed as follows:

There are files recovered in the directory named gif-1-0. If you want to scan the entire disk instead of just a specific partition, you can also specify the name of the disk. As an example, my disk name is sda six, and I use the command like this:

Linux Essay: Conclusion

After all, Scalpel is one of the most useful data recovering tools in Linux. Sometimes it seems quite complicated, but actually it is not. I have tried to explain the main principles of the tool in an explanatory way.

References

Benthin, F. Recovering Deleted Files with Scalpel " Linux Magazine. https://linux-magazine.com/Online/Features/Recovering-Deleted-Files-with-Scalpel.