Tools - ddrescue Delete Edit

Tools:

• ddrescue
• foremost
• sleuthkit
• autopsy (webgui for sleuthkit, req java)
• testdisk

Making Images

Async is faster, use Sync if there are too many errors

ddrescue --idirect --no-scrape --no-trim  --sparse --synchronous /dev/sde1 hpdisk.img hpdisk.log

ddrescue --idirect --no-trim  --sparse --synchronous /dev/sda1 ndir.img ndir.log

ddrescue --idirect --no-scrape --no-trim  --sparse --synchronous /dev/sda1 ndir.img ndir.log

ddrescue -n /dev/sdX recover.img recover.log -c 1 -O

--retry-passes=0 --max-bad-areas=+0 --timeout=1s --cluster-size=1 --reopen-on-error

Mount the entire disk image

losetup --find --partscan /path/to/image

Mount partitions

mount /dev/loop0p1 /mnt/example

https://wiki.archlinux.org/title/File_recovery https://help.ubuntu.com/community/DataRecovery