The following tutorial will illustrate how to take a block for block, sector for sector, bit for bit copy of any drive, both SSD and HDD. You will additionally be able to recover deleted files, as long as they have not been overwritten.
This works on public clouds too, so email your cloud provider and ask whether they zero out disks after use!
Requirements for physical access:
Secondary server/disk that is larger than the source disk.
USB or ability to insert recovery disk
Requirements for servers:
Secondary server/block storage/disk that is larger than the source disk.
Ability to insert recovery media to the server
Step 1: Create a Bootable Recovery Media (any distribution)
Boot into any live USB or live ISO distribution.
The easiest live GNU/Linux distribution to use is called GParted live.
TestDisk 7.1, Data Recovery Utility, July 2019
TestDisk is free software, and
comes with ABSOLUTELY NO WARRANTY.
Select a media (use Arrow keys, then press Enter):
Disk sda.img - 26 GB / 25 GiB
Choose EFI GPT
[EFI GPT] EFI GPT partition map (Mac i386, some x86_64…)
[ Analyse ] Analyse current partition structure and search for lost partitions
Ignore the Bad GPT errors and hit Enter for Quick Search.
Press the letter P to list files
You should be presented with the disk structure:
Step 5: Forensic Disk & File Recovery With Deeper Search
Press q to return to the menu with the disk and perform a Deeper Search to recover substantial files, including partitions that have been previously deleted.
The above example has so many Linux filesys. data copies because it is an image from an SSD inside a public cloud.
It will try to recover as many previously seen file systems that were on the drive.
This works much better for Hard Disk Drives but you can STILL recover files from SSD’s, as long as TRIM is not performed.
I’ve successfully recovered deleted partitions, files, and videos from Samsung SSD’s and Kingston SSD’s, as well as Intel SSD’s.
How to Defend Your Disks from Recovery
Single files can be deleted using shred or secure-delete
shred using the -n option will overwrite that file 30 times. This can take a very long time if the file is very large.
shred -n30 ./file.txt
shred can cause your SSDs to die faster.
apt/yum/pacman install bleachbit
Zero out any unused space using < shell operator > OR just use cat
You can just fill up the disk until the disk is full, and then delete that file:
# user zeros
cat /dev/zero > delete_me
# or use random characters
cat /dev/urandom > delete_me
# cat: write error: No space left on device
TRIM your SSD manually
sudo fstrim -v /
fstrim will literally reset every unused memory cell to factory state. This will prevent cells from being recovered. However, this might not include SSD cells that have been marked as bad sectors. Because SSD’s degrade over time, it is possible for some sectors to become undeletable.