Data Recovery in Arch Linux

1. TestDisk

TestDisk is a powerful CLI tool for recovering lost partitions and repairing a damaged MBR or GPT.

Installation:

sudo pacman -S testdisk

Usage:

sudo testdisk

TestDisk will guide you through an interactive (text-based) recovery process. Possible actions:

• Recover deleted partitions
• Restore boot sector
• Recover files from FAT, NTFS, ext2

2. PhotoRec

PhotoRec is a tool for recovering files from storage media — even with a damaged file system.

Installation:

It’s part of the testdisk package, no separate installation needed.

Usage:

sudo photorec

PhotoRec ignores the file system and attempts to recover data from raw sectors.

3. extundelete

extundelete allows you to recover deleted files from ext3/ext4 partitions.

Installation:

yay -S extundelete

(Available in AUR — requires yay or another helper)

Example usage:

sudo umount /dev/sdX1
sudo extundelete /dev/sdX1 --restore-all

Recovered files will be saved in the RECOVERED_FILES/ directory.

4. ddrescue

GNU ddrescue allows you to make a binary copy of a disk, even if it has damaged sectors.

Installation:

sudo pacman -S gnu-ddrescue

Example disk image creation:

sudo ddrescue /dev/sdX /mnt/backup/image.img /mnt/backup/logfile.log

You can later mount the image and try to recover the data:

sudo mount -o loop image.img /mnt/recovery

5. scalpel

Scalpel is a data recovery tool based on file header patterns and signatures.

Installation:

yay -S scalpel

Usage:

First, edit /etc/scalpel/scalpel.conf and enable the file types you want to recover (e.g., JPG, PDF).

sudo scalpel /dev/sdX -o /mnt/recovery/scalpel_out

6. rmlint (for detecting/removing duplicates and broken files)

rmlint is not a direct recovery tool but helps with disk analysis and preparing for recovery.

Installation:

sudo pacman -S rmlint

Usage:

rmlint /mnt/recovery_disk -o summary

7. Mounting and analyzing disk images

After creating a disk image (e.g., with ddrescue), you can analyze it using tools like:

• mount -o loop — mount image
• fsck — check and repair file system
• debugfs — explore ext4/ext3 structures
• foremost — recover based on file signatures

8. Practical tips

• Always create a binary copy of the damaged device before recovery!
• Avoid writing to the damaged disk — even temporary tool directories should be on a different drive.
• Don't give up after one tool — effective recovery often requires several attempts with different methods.

9. Data Recovery from Btrfs

Btrfs is a modern file system with snapshot functionality that can make data recovery easier — but in cases of severe corruption, it requires caution and understanding of internal structures.

Common scenarios:

• Deleted files – possible recovery from snapshots or raw scan
• Metadata corruption – use of recovery tools or backup
• Logical error or lost partition – recovery through image and Btrfs tools

1. Recovery from a snapshot (if available)

If the system has automatic snapshots (e.g., via Snapper or Timeshift):

sudo btrfs subvolume list /mnt/btrfs
sudo btrfs subvolume show /mnt/btrfs/.snapshots/123/snapshot
sudo cp -a /mnt/btrfs/.snapshots/123/snapshot/home/user/data /home/user/recovered

2. Using btrfs restore

The btrfs restore command allows exporting data from a damaged file system without mounting it.

Installation (if you don’t have Btrfs tools):

sudo pacman -S btrfs-progs

Usage:

sudo btrfs restore -v /dev/sdX1 /mnt/recovery