Linux

10 Linux rescue tools for recovering Linux, Windows, or Mac machines

When you're dealing with a system that won't boot, you need a robust and dependable recovery tool. Here are a few Linux tools that might save the day.

Our consulting firm has had a rash of problems recently that required the help of Linux rescue tools. From corrupt partition tables to severely infected machines, Linux tools come in handy when the host system won't boot. But because of the plethora of tools available, it's sometimes tough to sift through the cruft and find the ones that are usable. So I decided to highlight some of the better tools. I hope one or two of them will find their way to your toolkit.

Note: This article is also available as a PDF download.

1: Knoppix

[UPDATE: New link] Knoppix is one of the better tools for rescuing data from sick machines. It's a full-blown live Linux distribution with a strong, user-friendly GUI that will allow you to easily mount a drive and then copy the data (which you will locate in an easy-to-use file manager) to an external source. Of course, Knoppix comes with the full arsenal of Linux commands, which place just about everything you need at your fingertips.

2: Trinity Rescue Kit

Trinity Rescue Kit might leave you wondering, "Why isn't this tool being developed faster and on a larger scale? Although TRK is rather slow to develop, what it offers is just short of amazing. Place it on a USB drive, boot your virus-laden machine, and scan the mounted drives with clamav, antivir, bitdefender, and more. This tool is all command line, so you might have to bone up on your commands to really make use of it.

3: Avira AntiVir

Avira AntiVir is a command-line antivirus tool that is fast, robust, and dependable. There is a GUI tool, but installing it is almost more trouble than it's worth. (It requires Java.) Installing AntiVir on Linux isn't the easiest of tasks, but it's certainly no kernel compilation.

4: GParted Live

GParted Live is a live Linux distribution that allows you to manipulate partitions on a drive. It supports numerous file systems and lets you can resize, create, and delete, partitions. You can run GParted Live from a CD or a USB drive, so it's very portable.

5: SystemRescueCd

SystemRescueCd is another live Linux rescue CD that offers numerous tools to handle numerous tasks, including partition manipulation, file recovery, hard disk testing, ftp, and disk formatting. As with most live Linux distributions, you can place SystemRescueCd on either or CD or USB drive, and it offers an easy-to-use GUI and plenty of tools.

6: Ubuntu Rescue Remix

Ubuntu Rescue Remix is quickly becoming one of my favorite data recovery tools. Like all good live Linux CD tools, it includes an outstanding GUI (it is Ubuntu after all) that can help you handle tasks other tools can't handle. You can recover and rescue Mac files/filesystems, recover data from nonstandard external drives, recover deleted files, and more. The one thing URR is missing is antivirus tools. But, since this is a Linux rescue disc, once installed, you can simply add the tools you need to your USB live CD.

7: F-Secure Rescue CD

F-Secure Rescue CD is based on Knoppix and allows you to check the integrity of your installed applications. It also allows advanced data repair and recovery, as well as recovery from that ever-dreaded malware!

8: Ddrescue

Ddrescue is a Linux tool designed to copy data from one file block device to another. This tool will aid you in rescuing data when your drive is suffering from read errors. Unlike many of the tools on this list, Ddrescue is not a live distribution but a tool you will use on a running Linux machine. So to rescue data, you will have to attach that troubled disk to the working Linux machine.

9: Safecopy

Safecopy is similar to ddrescue, allowing you to copy files from a disk suffering from I/O errors. It also includes a tool that allows you to read data from CDs in raw mode, as well as issue device resets and simulate bad media for testing and benchmarking.

10: Linux rescue mode

This is the only entry on the list that isn't a downloadable tool. Linux rescue mode is a mode booted with the help of a Linux boot CD, allowing you to repair a broken system. From rescue mode, you can recover a root password, repair or reinstall the boot loader, and more. When you boot into rescue mode, it will typically mount your installed system into /mnt/sysimage, where you can take care of any business necessary.

More rescue tools?

These 10 Linux tools can help you recover, rescue, and repair a Linux, Windows, or Mac machine. Of course, plenty more tools are out there. Have you come across a Linux tool that can help you repair or recover a damaged or sick drive? If so, share it with your fellow TechRepublic members.

About

Jack Wallen is an award-winning writer for TechRepublic and Linux.com. He’s an avid promoter of open source and the voice of The Android Expert. For more news about Jack Wallen, visit his website getjackd.net.

63 comments
bilidania
bilidania

Hi I had a Sony Vaio laptop which I had installed Windows and Ubuntu, the laptop was stolen (end of Feb 2012), and now I may have found it back (end of July 2012), but it has been stripped of the parts including (possibly) the hard drive, when it was stolen I lost 8 years of photos which I stupidly didn't back up, my question is, is there any way to recover the photos, I read that Linux doesn't need a hard drive to run, can this somehow mean it can be accessed from the computer to recover my photos? Please don't be offended by my lack of knowledge of computers and operating systems, I am seeking your much more advanced knowledge in regards tho my problem. Thanks very much.

markp24
markp24

should we also mention "Offline NT Password & Registry Editor" live cd

bobp
bobp

Somebody mentioned XX Clone. It works well, but it is very S--L--O--W. Easeus ToDo Backup and probably others are much faster.

myfixlog
myfixlog

BootMed is a great live cd that comes with TestDisk, PhotoRec, ddrescue, virus checkers and other recovery tools. The best part is that it also comes with tutorials that guide the average computer user through using the tools. http://www.bootmed.com

lweldon
lweldon

dd is a tool that copies a device to another - I use it instead of the miriad of for sale drive and partition cloning software. dd if=/dev/sda of=/dev/sdb

Rob C
Rob C

I downloaded the latest Knoppix DVD iso, and burned to a DVD. I am pretty sure the burn was ok (and verified). When I then boot from the DVD, it gives the normal white writing on my CRT monitor, and a female voice says something. Not long after, the DVD makes reading noises, then rests. During that latter period my CRT goes blank, and the monitors status light goes yellow instead of green. That usually means that the monitor thinks nothing is sending it a signal. I am pretty sure Knoppix has loaded ok, but it aint sending anything to my monitor. I suspect that Knoppix cannot handle my KVM link. I have single monitor connected to two PC's via a KVM. I have done similar in the past to create a Puppy Linux LiveCD, and it runs fine, in that same PC. Seagate DiscWizard runs fine from a bootable CD. Paragon Partition Magic, runs fine from a bootable CD. Anyone got any thoughts ?

TucsonGuy
TucsonGuy

This place charges minimum 80 bucks for no more functionality than you get fro free with other tools!

bng44270
bng44270

Puppy linux beats the crap out of knoppix, if for no other reason, by booting faster due to lower system overhead. Check it out. I love it and use it daily.

MauricioRubio
MauricioRubio

Jack good article, since the article was published i just read a couple a days ago, and guess what?, the laptop (sony vaio VGN-TZ35FN/B) of the president of the company where i worked, crashed the OS (windows Vista)and the hard disk doesn't wake up to get the information. The IT team was afraid and they were running looking a company like a forensic technology for extract the information. then i read the article and i proposed to use Trinity Rescue Kit, i downloaded immediately and burned the ISO. The result was incredible i could extract the information, so i expected to receive at the less gratitude, but it wasn't. so it doesn't matter, the really important is the knowledge.

asics447
asics447

I have used Gparted the recently in the past 2 yesars and on several serves to resize those pesky small dell Windoes O/S partitions and it worked great and would highly recommend- Used it on very big partitions - 750 G and up and worked like a champ - It just took some time due to the resizing of large amounts of data/space but very awesome and can be run from a iso cd/dvd or memory stick

SkyNET32
SkyNET32

No AV tools, but its the best hard drive and recovery tool I've used. www.grc.com/

press
press

Hi Jack, thx, that sounds nice, - but: What do you use to recover when you accidentally began to format a Linux drive and stopp your mistake within 30 sec., when format had already began (Opensuse 10.3). Mac

jr.golden300
jr.golden300

Don't have time to read everyones comments, but did anyone suggest or mention puppy linux for data recovery? Works great by installing into RAM so it leaves the optical drive free. Puppy Linux 4.3.1. Also, AVG came out with a free ISO download that lets you scan for viruses and other miscellaneous tasks. Based on Linux of course... but more of a BIOS type of GUI. Hope someone finds this useful. That's my two cents!

MytonLopez
MytonLopez

The only tools I have used that was mentioned in the post is Knoppix and TestDisk which one of the users mentioned. I would say most of these are not needed unless you do not have the proper tools. I would add Avast Antivirus to the list. It is the a great Antivirus that is free. It is not Linux but it has a boot scan that will scan your hard drive before it boots into Windows to remove viruses. This is just as good as slaving the drive and running a scan. If the OS is corrupt I can most of the time fix it or if I jsut need to get data off I slave it using a IDE/SATA to USB cable that costs less than $20 most places. That is a tool everyone should have. And if Windows cannot read the data than I will try Knoppix. Only had to do that maybe twice. I had used TestDisk once and it worked but everything else in my opinion is not needed if you know what your doing.

larojas
larojas

Has anyone tried the Ultimate Boot CD (UBCD)? I have used it for years and has saved me many times. It has CPU & mem tests, HDD diagnostics for various brands, partition editors, etc. (http://www.ultimatebootcd.com/).

rmongenel
rmongenel

I am apalled that SpinRite isn't on this list (www.grc.com). That program is OS-agnostic and performs low-level driver recovery and has performed amazing saves.

nin_jkc
nin_jkc

I once had to fix a Windows machine that had a registry entry deleted - I found a pretty decent Linux distro that helped me out, RIP (Rescue Is Possible) - it has a large selection of tools for doing everything from editing your registry to backing up a corrupted drive. It comes in a Linux live cd.

Calcom Tech
Calcom Tech

We just ran into a situation where the root password for a Linux server was unknown and the first thing we did was download knoppix. It helped us gain access to the server and complete our job. Then today I read this article. When it's right, it's right.

Rob C
Rob C

It requires very little memory. The CD can be removed (after loading), freeing up the CD drive, for burning, etc. It can see all your drives, and USB drives. It can retain settings, data etc. This is soooo easy to do, and can be retained to hard drive, USB thumb drive, and possibly to a CD/DVD (haven't checked that out). I have only dabbled, with Linux systems, but I like Puppy's as much as any of them. It has that annoying, Apple like, habit of showing separate windows for each drive, instead of a decent file Manager, apart from that it is terrific.

TG2
TG2

I'm surprised you didn't likst Avira's Antivir Rescue System CD! Its linux bootable cd .. you can download the ISO or cd wizard versions which are updated daily.. Once booted, you'll need to switch to English by clicking the British Flag (defaults to German) then set config operations to rename (or delete) virus infected files, otherwise it only scans and tells you you're infected ... like duh, you'd probably not be running such a tool if you weren't already infected. Avira AntiVir Rescue System http://www.avira.com/en/support/support_downloads.html

wizard57m-cnet
wizard57m-cnet

then you can't recover the pictures. If you have the hard drive, it may be possible to recover some of the data, but that can be expensive. Try posting a question in Q&A, rather than to a 2 year old discussion, someone may be able to point you in a better direction.

lweldon
lweldon

I use KVM switches and though they are sometimes a slight problem - never just no video. You really should be sure the checksum on your download is good.

TristanGrimaux
TristanGrimaux

* offer to solve the solution * make a copy of the disk (with a prg like dd_rescue * try to rescue the data with the tools you know * go straight to the president to check if what you have is useful * smile a little and go away without ado * collect the gratitude and a raise!!! en espa?ol: * Ofr?cete a solucionar el problema * Haz una copia del disco en problemas y trabaja sobre la copia -usa dd_rescue- * rescata todo lo que puedas con las herramientas que ya conoces * ve directo al presidente para verificar que los datos que haz podido recolectar son de utilidad * sonr?e un poquito y vete sin decir mucho m?s * recibe el agradecimiento y un aumento!

justagallopin
justagallopin

I was happy to see puppy listed a few times. My favorite to recover files and partition in a hurry. The live avg cd is helpful as well and if cdrw I believe I was able to update it too. Used it when I discovered it and haven't had to again...yet, but was helpful to get the clean up started. Still had to slave to MS partition to scan with favorite antimalware programs next.

MytonLopez
MytonLopez

I forgot to add that for cloning a drive I use ghost and never had an issue for they have a switch for just about everything. Ghost is not free but it is reliable and recommend it.

kevinmchambers
kevinmchambers

I agree that Spinrite has worked wonders, even on SATA drives. But version 6.0 came out in 2004, with limited SATA support. We've been told 6.1 is coming, but even the webpage hasn't been updated since 2006.

mousejn
mousejn

You can run windows Anti-Virus & Anti-Spyware off a CD or USB drive. It lets you remotely mount the registry which really help in malware removal. I also like OPHCrack for users that forgot there password or terminated employees that you don't know their passwords.

Benny7440
Benny7440

... At just under 50MB it can boot up from a mere 64MB USB device & run from RAM. Has some useful utilities & even games! Give it a look/try & see for yourself a new meaning for speed & compactness - hope you like it.

datashepherd
datashepherd

Windows and Linux viruses are different. If this Live CD is intended for use on a Linux partition, then it will be of limited use on a Windows one. Do you if it uses windows-based definitions and heuristics? Sure be handy if it did.

AshleyJoliver
AshleyJoliver

@wizard57m-cnet  Why go for rescue if you can recover your data anytime I would like to recommend Recover Data tools all in one Recovery software is an effective data recovery software for hard drive partition recovery and highly specialized restitution tool defend data lost due to virus infection, software faults, power failures, corrupted hard drive etc. The versatile utility would automatically check and recovers lost data of various hard drive.It works for windows,Linux,Mac.

Oldmanmike
Oldmanmike

So I've rebuilt my mother-in-law's machine, (Vista) and have all S/W installed, updates, etc. Any suggestions for a good backup utility I could run that would be similar to Ghosting the PC? I know in a month she'll have installed more malware and will need it recovered, and I'd like to ghost it in a good state this time.

ultimitloozer
ultimitloozer

Includes everything. Backup/restore, migration, partition/disk imaging, recovery tools, cloning, conversion to virtual disks, and tons more. Only about $50 right now. Check their website at www.paragon-software.com.

joseph.r.piazza
joseph.r.piazza

Macrium Reflect...is great. Only problem I had was imaging to DVD's did not work.....but imaging to an external drive works perfectly. Go to CNET for dowmloads.

Rob C
Rob C

Hi, Your post was shown as a reply to my docking thingy post. Was your question in response to my post ? If so, I don't use my external docking thingy for booting, in the scenario I was describing. When ever I need to restore one of my backup images, I just boot into the DiscWizard CD, and tell it to replace the partition (or whole drive).

KiloWatt1975
KiloWatt1975

Go figure, a little NoWhereNewMexKilo town has 2 members posting! LOL Boomer, post private, KiloVideo at gmail. Is this Ray?

KiloWatt1975
KiloWatt1975

I must have missed a step, but when I tested USB OS/programs backup, the USB was in use and I failed at being able to boot from USB selected in BIOS or F11. Any thoughts? Thanks

KiloWatt1975
KiloWatt1975

Yep, WD does a full clone not a gohst. I have a system with WD and SeaGate drives, I clone to and from with no issues. It is all a matter of what you want to spend time on. As most use My Documents as designed, all work is stored there, I copy a corrupt MyDocs to my source drive before I clone, then redirect the files when a program is searching for the data.

techrepublic
techrepublic

The Western Digital site has a WD-drive-specific version of Acronis.

mjs1138
mjs1138

After the system is "SET" run Acronis and set up the hidden partion backup process. This will allow a restore to the original state by pressing F11 at boot time. Put "my documents" in a separate partion so data is not lost.

Boomertechhelp
Boomertechhelp

It runs in windows and does a superb job. I've used it several times now. The first time to save my own server! Make a clone to a spare HD, disconnect HD, continue to back up important data to external location. When original HD crashed, swap with clone, import data, VOILA!

fred64
fred64

This is the free tool I use. It can create and copy partitions on the same drive or between drives. You can get a bootable iso or you can install it on a working system. Another good one is Easeus partition master home edition. Both are free (not trialware) and available on cnet and other popular sites.

Rob C
Rob C

Download Seagate's DiscWizard, and burn to CD. Get an external Docking thingy ($30 Aust). Get an Internal 3.5 inch 500GB Seagate SATA drive ($55 Aust). Shove it vertically into the Docking thingy. Connect it, via USB cable to your PC. Set your PC bios to boot from CD. Boot up with the DiscWizard CD. Backup your Drive to the External Drive. Yell out if you need further clarification. PS I use it all the time (as described above).

KiloWatt1975
KiloWatt1975

I've not had to replace a corrupt HDD in 5+ years with using DiskWizard/AcronisLite. It is the best PM tool imho, to have a real bootable OS/programs backup. In my systems, I will configure programs to make my work easier. When I like how the configuration is working, I format a target drive then clone. As OEM OS have smaller drives, I attach and do updates to see if there are any problems with my expensive programs. The tools posted here have their place for helping when a Window problem happens, but to just boot to a backup drive then reclone is just faster than searching and copying files. My main editor has 3 boot drives, with only one drive able to connect to the web. Downtime is only a matter of softboot, not spending time$$ trying to fix a problem. Also, the SATA300 disk is backward compatible to ALL seagate drives. POV... fwiw Norton Gohst does not do this same clone. You have to leave the main drive connected to boot to it's supposed clone.

duncan.pope
duncan.pope

If you have any seagate or maxtor drive in the system or attached, Seagate FREE diskwizard is a slightly restricted version of Acronis. It works very well.

TristanGrimaux
TristanGrimaux

The amount of virus in Linux is not worth enough to write a tool to eradicate them, at the moment.