Linux Data Recovery

Warning: The information contained in this review dates back to late 2007 and is very likely out of date! However, since a check early 2014 showed that most of the programs mentioned are still in the market (which is remarkable to begin with), and I need some sample texts to test my new site infrastructure, I'm leaving it here with this warning.

Well, fate is determined to let me learn a lesson on the importance of backups! Only one week after I had some data lost due to the corruption of data on my cell phone's SD card, the hard disk (a 250GB Samsung SP2514N in a fanless Revoltec Alu Book enclosure) attached to the Linksys NSLU2, which I use as a NAS server, suddendly is seen as "Disk Not Formatted" by the system. For those not familiar with the NSLU2: it is a low cost Network Storage Device that allows you to attach up to two USB 2.0 Disk Drives making them accessible in the local area network. As it is Linux-based, there is an active community maintaining alternative firmwares to take full advantage of it as a little server beyond what Linksys designed it for.

As I use that server mainly for backups from other machines (!) and repository of downloads from the internet, I don't have a current backup of it (of course, only the non-backup stuff is what I'd backup from that machine). Even though no important data was lost it is still a pain, as for example all the programs I need to reinstall on my cell phone were recently downloaded to that server. To complicate matters, the NSLU2 by default uses the ext3 Linux file system on the (USB-)attached drives. So in this article I describe my recovery attempts and review Linux Data Recovery Software.

Programs discussed in this review

As the NSLU2 was only partially operational without the attached disk (it had been "unslung" meaning that a new firmware and a partial displacement of the operating system to the hard disk had taken place) and I had only an out of date Linux installation on a very old machine, I started looking for Windows based programs that would allow me to recover at least part of the data on the ext3 formatted disk. Fortunately there are quite a few such programs (many more than those I discuss here, the selection being somehow arbitrary and incomplete). However, as scanning a 250GB disk takes up to six hours, I ended up testing only the following five programs (stopping when I found the first one with satisfaying results:

 

DiskInternals Linux Recovery 1.2

This free program does a thorough scan of the hard disk which takes for this 250GB Samsung about four hours.

Disk Recovery Wizard

But, unfortunately "you get what you pay for" as the program does not find any recoverable files for the directories that I need to recover.

As opposed to other program below, it does recognize the first level directory structure correctly (although some directory names appear twice in the listing)

DiskInternals Result

Quick Recovery for Linux

This commercial package by Unistal was the only one to explicitly show a "Bad Sector Encountered" error message:

Quick Recovery Bad Sectors

"Skip All" then starts a search for partitions with an estimate of more than five hours to run. As in the FAT round up the corresponding Quick Recovery for FAT displayed deleted files (which is good) but had no way to filter them out (which isn't), I decided to move on to other programs and only return to this one if necessary.

EASEUS Data Recovery Wizard Professional

After a quick partition search the system starts an "intelligent searching" which took more than five hours to complete:

EASEUS Intelligent Searching

Unfortunately, the result is quite disappointing for this concrete case as only empty Inodes were found, even though a total of 79.22 GB in 11696 claim to have been found:

EASEUS Results

Again, this might be a singular problem with this drive or I might have not used it properly. As opposed to other programs the Data Recovery Wizard demo comes with a comprehensive documentation:

EASEUS Documentation

Stellar Phoenix Linux 2.5

This program yielded the best results in terms of number of recoverable files and information about them. The following excerpts from the log detail the recovery process:

Physical disk #2 selected
UNKNOWN,version UNKNOWN
Sun Oct 21 11:36:13 2007
-------------------------------------------------------------------------------
Searching logical drive/ volume
Search sector range 0 to 488392065
Started on Sun Oct 21 11:36:26 2007
Logical drive / Volume 1
Found at sector No. 63
Logical drive / Volume 2
Found at sector No. 487910115
Process completed
Completed on Sun Oct 21 11:42:06 2007
-------------------------------------------------------------------------------
Logical drive / Volume #1 selected
Drive/ Volume starts at sector 63, Size 232.654 GB
Sun Oct 21 11:42:59 2007
-------------------------------------------------------------------------------
Creating directory tree
Process started
Started on Sun Oct 21 11:42:59 2007
Process completed
Completed on Sun Oct 21 16:11:15 2007
-------------------------------------------------------------------------------
Saving scan information of drive to a file
F:\Stellar Phoenix\Stellar Phoenix LINUX Scan.DAT
Process started
Process completed

So the scanning process took about 4.5 hours and yielded 79220 GB in 10298 files in 506 folders including a "Lost files" folder:

Stellar Results

The results are presented in an explorer like fashion that allows sorting by any of the available columns (name, type, size, modified date, etc.). I did not come as far as actually recovering the files nor does the evaluation version allow you to view selected files to tell if recovering them would be worthwhile. What prevented me from doing so was the price of US $79 (at the time of this writing, Nov. 2007) as I had another program waiting to be tested that claim to get me the same for 30 bucks less. Furthermore, maybe because of running so many hours there were some strange graphic effects with "holes" in the main window...

Nucleus Kernel for Linux

This program has a very simple but appealing user interface with few clearly defined actions that can be performed either by pressing one of the large buttons or by navigating the menu:

Nucleus Startscreen

So after searching for the partitons on the defective drive I started the scan expecting it to take the usual four to six hours to complete. But surprisingly it was done in less than one hour (!), even though it found pretty much the same recoverable files as Stellar Phoenix (the numbers differ, but as far as the for me relevant files concern: they are still there!):

Nucleus Drive Information

I guess the reason for this astounding speed is that the default settings define 60 sectors to be read in a single attempt, whereas other programs read sector by sector.

Nucleus Recovery Settings

The post-mortem analysis of the hard disk using Samsung's HUTIL drive diagnostic utility revealed that only one sector was damaged (but it happened to be the crucial one at the beginning of the volume!). Thus, in cases as mine the hard disk can be analysed much faster. In other cases, of course, this strategy would miss recoverable files, but you can always change the setting to a lower value.

The next positive aspect was being able to just doubleclick on the files found to open them using the native associated application:

Nucleus Explorer

So this programs looked like a winner and I went ahead and bought it for US $49. It seems to be necessary to uninstall the demo version and install the full version in addition to entering the registration information. Recovery went smooth and fast, but then I discovered, that the original time stamp was not restored. So I wrote to support:

I was able to recover the files from a broken ext3 partition. HOWEVER, even though the preview shows the correct creation date of the files, the recovered files all have the recovery time stamp as creation date. For my purposes, this is a big handicap! Is there any way to recover the proper creation dates of the files?

And got a promising answer almost immediately:

I think our support staff has got a patch for this problem. Please drop an email to This email address is being protected from spambots. You need JavaScript enabled to view it. with your order number and the problem

And that mail was answered with:

We will send the patch to you whithin 24 hours.

But it never happened even though I insisted several times in follow-up e-mails. So probably this is a known limitation of the program and they are just trying to talk themselves out of the 30-day money return warranty period...

Conclusion

In my personal opinion Stellar Phoenix Linux is probably the most thorough program of those tested but also the most expensive. Nucleus Kernel Linux was fast and was the program I actually bought and used, but I was disappointed by their support promising something they did not deliver. Loosing the creation date of files is more of a pain than what I thought at first, in particular for archival purposes, where one would search by date rather than by name or directory. Next time (no, wait!... there will be no next time, I hope) I would make sure the program I buy restores dates.

 

Login