Recovery under Linux gives one more options, but is sometimes more complicated than for Windows.
The best way to recover data is to do an full image of the data and work with the image.
If something goes wrong during recovery, the image can be discarded. Working with a large external drive gives you the option of doing copies all over again. So experimenting is not an issue.
In case only one or two data files must be recovered it can be as easy as just booting with a Linux live image and copying the required data to a USB stick or external drive.
If drives are encrypted my advise is to go into recovery mode and unencrypt and after it recover the drive.
Text, PDF, DOC, ODT, Databases, SQL, CSV, Gnucash, code like .xpi, jsp, cab, sxw (presentation like powerpoint) and other text based files can be recovered 90% in most times.
In .mbox or .msf data one can see crucial emails.
Just open small files with xed, kate or any other text editor for esay viewing.
Viewing a large amount of data and scrolling is better with nano under the terminal.
Some libre office data is disguised as zip data or vice versa. So look at every file carefully.
Some .elf, system files and fonts are also almost always restored. But for most people these files are not important.
To view files larger than 100 KB I recommend using vi. Use q:! to quit and do not save anything.
Images are saved as thumbnails in most cases. large images can only be recovered partially. So I would give it 30%.
Audios/Videos are in between. Some videos can be recovered in full, others only partially as snippets, with only sound or video. The best way is to view the videos with VLC.
Recovery in most cases takes two hours, because scanning the drive takes time and than dividing good files from garbage also takes time.
Personally I look at data bigger than 1 MB and look at the error from vi, like:
“Photorec/dm0/
recup_dir.76/f25407184.elf” [Incomplete last line][converted] 16165 lines, 11097
345 bytes
Press ENTER or type command to continue
For some people, emojis are important for others not.
We used the following tools
DDrescue – For doing an image
Extundelete – Only works on older system
fsck- Good software to fix
Grep – A libre search script which I have not used so far.
OnTrack- I have only read good things about it, but it costs a lot and it must be used multiple times for good results.
Photorec- Very popular and gives quick results
For Windows
Image recall
Some time ago I had issues with the space on my harddrive. Without hesitation and thinking much I deleted some big data, mainly logs or that I thought.
My sytem is a Mint 20.04 and has time shift build in by default.
That means that all system and configuration is saved.
This software is not available in the live image. So I booted with a USB stick an Ubuntu 20.04 live image, downloaded the deb package installed timeshift.
After that I could recover the most recent configuration and boot into mint again.
For the record, there is also a possibility to restore Grub: grub recovery mode (German).
In this case it did not solve the issue.