35 Free Open-source Data and Files Recovery and Forensic Apps, and Scripts
Data recovery is the process of retrieving lost, corrupted, or deleted data from a storage device such as a hard drive, USB drive, or memory card. Data recovery is often used to restore important files that have been accidentally deleted or lost due to hardware failure or other issues.
Data and file recovery tools are software applications that can be used to recover lost or deleted data from a storage device. These tools work by scanning the storage device for any recoverable data and then restoring it to a new location. There are many different types of data and file recovery tools available, both free and paid.
Challenges in data recovery and file HDD forensics tools
One of the biggest challenges in data recovery is dealing with physically damaged storage devices. In some cases, the damage can be so severe that it is impossible to retrieve any data from the device. Another challenge is dealing with encrypted or password-protected files, which can be difficult or impossible to recover without the proper credentials.
Hard drive forensics tools add an extra layer of complexity to data recovery, as they are designed to extract data from a storage device in a forensically sound manner. This means that the data is retrieved in such a way that it can be used as evidence in a legal case.
Advantages of using open-source data recovery tools
One advantage of using open-source data recovery tools is that they are often free to use, which can be a big cost savings for individuals and small businesses. Additionally, open-source tools are often highly customizable, which means that they can be tailored to meet specific needs.
Another advantage of using open-source data recovery tools is that they are often backed by a large and active community of developers and users. This means that issues can be quickly identified and resolved, and updates and improvements are often made more frequently than with proprietary software.
Hamza Mousa
In this post, we offer you the best open-source and data and file recovery tools. Some of them require advanced level of expertise to use, the others are fairly easy to use.
1- PhotoRec & TestDesk
PhotoRec is a powerful, confident, and free open-source software that can effectively retrieve lost data from various storage media, including hard disks, CD-ROMs, and memory cards, regardless of the media's file system, even if it has been damaged. Distributed under the GNU General Public License (GPLv2+), PhotoRec is accompanied by TestDisk, which is an exceptional program to restore non-bootable disks.
To ensure data safety, PhotoRec utilizes read-only access to recover lost data. To avoid overwriting lost data, it is essential not to save the recovered files to the same partition they were stored on.
cgsecurity
2- TestDesk
TestDisk is a highly effective, free, and open-source data recovery solution that is designed to check the partition and boot sectors of your disks. It is highly useful in recovering lost partitions, which can occur due to a variety of reasons such as disk failure, virus attack, or accidental deletion. It can also recover files that have been lost due to corrupted or damaged file systems.
TestDisk is equipped with advanced features that make it a highly versatile and reliable solution for data recovery. It can detect and recover deleted partitions from FAT, NTFS, and ext2 file systems, as well as find lost partitions and recover boot sectors. Moreover, it can also fix MFT (Master File Table) corruption. With its easy-to-use interface and step-by-step instructions, TestDisk has become a popular choice for both beginners and experts alike.
In addition to its data recovery capabilities, TestDisk can also be used to fix partition tables, rebuild boot sectors, and recover deleted files from FAT, exFAT, NTFS, and ext2 file systems. It can also be used to recover data from damaged or formatted disks, as well as recover data from USB drives, memory cards, and other storage media. With its extensive range of features and capabilities, TestDisk is an indispensable tool for anyone who wants to recover lost data and restore damaged disks.
Features
- Recover partitions
- Dump boot sectors
- Check disk geometry
- Intel partitions supported
- EFI GPT partitions supported
- XBOX partitions supported
- Files recovery
darinwz3- Kickass Undeleted (Windows)
Kickass Undelete is a reliable file recovery tool for Windows users. It is a free software that offers a wide range of features to help you recover lost data. Whether you accidentally deleted a file or lost data due to a system crash, Kickass Undelete can help you retrieve it. The software scans your hard drive, flash drive, or SD card to locate all the deleted files and presents them to you in an intuitive interface.
Not only does Kickass Undelete locate lost files, it also helps you recover them in a safe and efficient manner. With its powerful recovery algorithms, the software can restore files of various types including documents, photos, videos, and music files. The recovery process is quick and easy, and you can select the files you want to recover with just a few clicks.
Kickass Undelete is a must-have tool for anyone who wants to ensure that their data is always safe and secure. With its user-friendly interface and powerful features, you can easily recover lost data without any hassle. Don't let data loss ruin your day, download Kickass Undelete today and get your files back in no time!
Features
- Free and open-source
- Easy to use
- Fast scan
- Supports both NTFS and FAT
- Filter by filename and extensions
sniffles
4- FreeRecover (Windows)
FreeRecover is a comprehensive and reliable file recovery program that is specifically designed for NTFS drives. This amazing software allows you to easily search through and preview deleted files to help you find lost data. With FreeRecover, you can rest assured that your deleted files will be recovered with ease.
Moreover, this powerful tool comes equipped with a unique feature that estimates the integrity of the deleted files, ensuring that the recovered files are still usable.
Additionally, FreeRecover is equipped with an advanced algorithm that retrieves the original file paths of the recovered files, making it easy for you to access and restore your data in no time. Whether you accidentally deleted important files or lost data due to a system crash, FreeRecover is the perfect solution for all your file recovery needs.
srgrass5- RecoverPy (Linux)
RecoverPy is a superior tool that maximizes your system's capabilities to recover lost files. Unlike other tools that are limited to recovering deleted files, RecoverPy can also retrieve overwritten data. It comprehensively scans every block of your partition and even has the ability to locate a string in binary files.
It is written in Python and can be installed on Linux.
PabloLec6- Dart (formerly apfs-tools)
Drat is an open-source tool for analyzing and recovering data from APFS (Apple File System) partitions. Its creation was inspired by a personal data loss incident and Jonathan Levin's closed-source fsleuth tool, which he demonstrated in this lecture.
The name "Drat" is a loose acronym for "Disaster Recovery APFS Tools", and a bad pun on how one might say "drat!" after discovering that their data is corrupted.
jivanpal7- Fatx-Tools (Xbox, and Xbox 360)
These are a set of data recovery tools for the Xbox Original and Xbox 360 consoles.
- These tools are still a work in progress!
- These tools were written under a Python 2.7.16 environment.
- It is not yet compatible with Python 3.
- Usage instructions will eventually be written.
aerosoul948- FATXTools (Windows)
FATXTools is a data recovery tool for FATX file systems. The goal of this project is to automate searching and recovering deleted files as well as provide tools for manual data recovery.
Features
- Supports loading from HDD images or physical devices.
- Use the Cluster Viewer to visually see what data occupies any cluster.
- Metadata Analyzer scans for abandoned file system metadata.
- File Carver scans for files based on their file formats.
- Save results to an editable and reloadable JSON database.
aerosoul949- Data-Recovery
This application is designed to help users recover lost or forgotten data such as Wi-Fi passwords, browser data, browser passwords, and other sensitive information from their computers.
With this application, users can easily recover lost or forgotten Wi-Fi passwords and other login credentials, as well as browsing history, bookmarks, and other web data. This makes it easy to recover data quickly.
The data recovery process is secure, as the application does not store or share any sensitive data. Additionally, the application is highly efficient, with fast scanning and recovery times, enabling users to recover their lost data quickly and easily.
It comes with 2 versions: Python, and C++.
hirusha-adi10- escalite (SQLite)
SQLite forensic tool, developed to make the analysis of SQLite databases easier. Primarly used for an university course about IT forensic but probably also useful for CTFs and other use cases. No guarantee of completeness or correctness.
All classes are combined in one file to make the program as portable as possible. Python libraries that are not part of the standard python installation are optional (for example graphviz).
nicolas9311- LockKnife (Android)
LockKnife is a command-line tool written in Bash that helps you recover Android lock screen passwords of an Android device.
Features
- Convenient terminal-based tool to recover Android lock screen passwords.
- Easy-to-use with interactive prompts.
- Supports Android devices with USB debugging enabled.
- Automatically connects to the device using ADB.
- Auto Decrypts the password file (assuming default encryption) and displays the recovered password.
ImKKingshuk12- drutils
An open-source set of tools to analyze, find, and recover deleted files.
Here are the included tools:
- raid-stat.c - raw disk visualization tool :)
- indx3.c - raw disk data scanner, tries to detect file types, partitions and ntfs metadata
- lstree.py - ntfs MFT file parser and fixer
- testfiles.py - file content validator/verifier, supports: old msoffice documents (doc/xls/ppt and other OLE2 files), new office documents (docx/xlsx/pptx and other ZIP-based xml files)m common image formats (jpg, png, psd), and pdf files.
- testjpeg.py - jpeg parser & validator, used by testfiles
- testpdf.py - pdf parser & validator, used by testfiles
- lzw.py - pdf LZW decompress, used by testpdf.py (not my code)
- lznt1.py - ntfs decompress, used by lstree.py (not my code)
gereoffy13- hfstools Tools for reading or recovering files from an apple HFS+ filesystem
Tools for reading Apple HFS+ filesystem images, written in perl.
nlitsme14- NTFS data-recovery program
Dead-simple (and somewhat stupid) NTFS data-recovery program. Works with Python 2.7 or Python 3.x, no dependencies. It can be used to recover deleted files or files off of damaged drives, although recovery quality will depend on how badly the file data has been damaged or overwritten.
nneonneo15- iRestore File recovery tool for the FAT file system
This program recovers files from the FAT filesystem. Made for the class CIS 3605.
n-bruno16- Disck Drill (macOS)
This app is a free app that helps you to recover deleted, lost, or damaged data, personal or business documents, music, photos, videos, and other files from internal, external and virtual hard drives, memory cards, iPhones, iPads, Android devices, RAID arrays, and other data sources.
The developers also offers a professional version and a high verstile Windows edition.
17- DiskDigger photo recovery (Android)
DiskDigger a free Android app that can undelete and recover lost photos, images, or videos from your internal memory or external memory card. Whether you accidentally deleted a photo, or even reformatted your memory card, DiskDigger's powerful data recovery features can find your lost pictures and videos, and let you restore them.
18- git-recover (Git)
git-recover allows you to recover some files that you've accidentally deleted from your working directory. It helps you find files that exist in the repository's object database - because you ran git add - but were never committed.
ethomson19- Recuva (Windows)
Recuva recovers files from your Windows computer, recycle bin, digital camera card, or MP3 player!
Piriform Software Ltd
20- Savvy DOCS Recovery (MS Docs)
This open-source tool allows you to recover MS Docs corrupted diles.
Features
- Recovers some DOCX files that Word will not open.
- Automatically iterates through four methods for recovering the document.
- Simple GUI interface.
21- MS Word Recovery (MS Word Files)
S2 Recovery Tools for Microsoft Word is a highly effective tool for recovering corrupt MS Word files. If you are struggling with a Word file that won't open, you know how frustrating and time-consuming the process can be. Luckily, Microsoft provides several methods for recovering corrupt Word files, and this software simplifies the use of those methods and provides 5 additional independent methods for recovering and opening corrupt Microsoft Word DOC and DOCX files.
One of the key benefits of this software is that it provides links to two pieces of freeware that were not coded by the author. The first is a free service that takes 14 days to complete, but can be highly effective at recovering corrupt Word files. The second is a featured commercial solution that is an affiliate of the author's, and may be a good option for those who need more advanced recovery features.
In addition to these external resources, the software also includes its own native previous file version recovery tool. This tool works with any version of Windows from Vista to Windows 10, as long as System Protection has been turned on in the System App of the Control Panel and a Restore Point has been created. This feature alone can save you a tremendous amount of time and frustration, as it allows you to quickly and easily recover previous versions of your Word files.
Features
- One button access to most of Microsoft's suggested MS Word recovery methods.
- Easy access to prior versions of your corrupt file if they exist on your Window Vista, 7 or 8 machine.
- Easy search for backup and temporary versions of your file.
- Several proprietary additional methods of doc and docx recovery.
- Easy access to two pieces of freeware, not coded by the author, for doc recovery.
johnconner59622- Dolphine DVR Pro CCTV Recovery
Dolphin DVR Recovery Pro. Business Version is the top professional CCTV DVR data recovery software which helps to access HDDs and Sd cards of CCTV, DVR, NVR, HVR, digital cameras, video recorders, etc and recover deleted videos efficiently.
Features
- Support 93 Video Surveillance Systems Brands, 30 digital camera systems and 33 video recorder system;
- Support video recovery from unknown/non-listed digital cameras and video recorders, that means users can try to recover any digital cameras and video recorders by Dolphin unique video recovery solution only if the videos are not overwritten;
- Support E01, DD Raw, IMG and other types of image files;
- Recover deleted videos, formatted videos and lost videos due to video surveillance devices;
- Faster software upgrade to add new Surveillance Systems for video recovery;
- Higher success rate of recovering and restructuring fragmented video files;
- Detailed report on the case;
- Easy channel and dates file directory display and recovery;
- Smart and new technology to recognize the video and audio frame；
- Easy video search by dates and time to find the videos to recover;
- Easy anti-interruption design during video recovery process.
23- CheckDisk Portable (Windows)
CheckDisk is a tool to search & repair disk errors, quite similar to ScanDisk or chkdsk.exe. You can select either standard or full test mode. The full test additionally performs a sector check. It is capable of finding bad sectors on your disk and marking them. The program works with hard disks (including SCSI and RAID) and removable media.
24- Corrupt Open Office Recovery (Open Office Docs)
A simple GUI program that attempts to fully recover unopenable corrupt Open Office files or at least salvage the text.
The program now offers an Alternatives menu with links to advice, services and software alternatives for recovery, including a shortcut to Recoveronix File Repair Online's corrupt file recovery service.
Features
- Attempts full recovery of unopenable Open Office files.
- Allows attempt at salvaging or extracting text as well.
- Has a zip repair pretreatment for both the full recovery and salvage methods.
- Provides an editor for salvaged text allowing for changes or clean up to text before saving.
- Has an Alternatives menu, offering links to advice, commercial software and services for recovery.
tfileme25- Corrupt DOCX Salvager (Windows)
Previously known as Damaged DOCX2TXT, this GUI program will extract text from damaged/corrupted Word 2007 - 2013 DOCX format documents.
DOCX files are actually zipped collections of mostly XML files. The main text in docx files is found in document.xml file in the collection. Corrupt DOCX Salvager uses 7Zip, an unzipper that sometimes unzips partially corrupt document.xml files despite reporting an error.
XML as a format is unforgiving of data corruption but Corrupt DOCX Salvager uses a Perl routine used to extract the text from the document.xml file which doesn't care about well-formed XML, a recovery stumbling block for Microsoft Word.
tathiwitch26- USBRescueX (Windows)
USBRescuex in its version 2.1 is a computer program category in utility software for files and folders, which its main function is the recovery of hidden files, read-only and corrupted our device (either USB memory devices, removable storage or hard disk).
Besides recover those important files for you , eliminates the famous RECYCLER virus , which is the basis of other USB flash drives for viruses , this virus is the main wrongdoer in your USB/Storage Device/Device Storage space Removable memory/disk hard, as the virus will hide all your files and folders , creating false shortcuts and reproducing more viruses to your computer and other USB/removable Devices/Hard Drives storage.
27- CD Reader (Windows)
CD Reader is a software for recovering datas from corrupted cds/dvds. This simple tool accurately recovers both individual files and full discs that your disc drive finds difficult to read due to scratches or other damages in the disc surface.
28- Zip Recovery (Cross-platform)
Zip Recovery is a cross platform, light weight, fast and easy to use app that can extract broken zip files which can't be extracted using common archiving tools.
sennyoo29- Force Copy Beta (Windows)
Copy corrupted files from scratch CD, DVD, Flash drives, which are not able to copy by normal window 'copy and past' method. This is good tool for coping media ( audio or video ) files.
30- DISK DOCTOR recovery toolkit (Linux)
Live-System based on Linux Mint with data recovery tools.
31- S2 Recovery Tools for Microsoft Excel
Microsoft recommends several methods for recovering Excel data from corrupt spreadsheets. S2 Recovery Tools for Microsoft Excel makes it easy to follow these recommended routines by just pressing buttons.
The application also adds five methods of its own for recovery. Additionally it has its own native previous file version recovery tool which works in any version of Vista, Windows 7 and Windows 8. Another feature of the program is a preloaded search interface for finding temporary, deleted and lost versions of your corrupt file.
32- Mondo Rescue (Linux)
Mondo Rescue is a GPL suite designed to create disaster recovery or cloning physical or virtual media from which you'll be able to boot in order to restore or clone your original system. It does that in an automatic or interactive way allowing modifs.
It supports tapes, disks, network and CD/DVD as backup media, multiple filesystems, LVM, software and hardware Raid, BIOS and UEFI.
Features
- Works on more than 60 distributions/version/architectures
- Supports ext2/3/4, XFS, reiserfs, sshfs, NFS,LVM, DM, ...
- Backup on CD/DVD/Tape/NFS/ISO/USB/HDD
- Restore from CD/DVD/Tape/PXE/USB/Virtual media
copop
33- ZipRec
Tool to recover data from corrupted ZIP archives and DEFLATE-compressed streams from other files and disk images. It is a free libre open-source solution (GPL3.0)
Features
- disk/memory image scanning
- ZIP/gzip/zlib streams, PDF FlateDecode streams
- text reconstruction using language models
34- ddrescueview
This small free tool allows the user to graphically examine ddrescue's mapfiles in a user friendly GUI application. The Main window displays a block grid with each block's color representing the block types it contains. Many people know this type of view from defragmentation programs.
The program is written in Object Pascal using the Lazarus IDE. It can be compiled to run on Windows, GNU/Linux and probably OS X, too.
Features
- Display ddrescue mapfile in a colored block graphic
- Examine each block in the image with a detailed list of map entries inside
- Zoom inside the mapfile, down to sector level
- To keep track of the rescue process, ddrescueview can automatically re-read the mapfile
- Overlay a domain mapfile, if you use one with ddrescue
- Units can be displayed with decimal (KB, MB...) or binary (KiB, MiB...) prefixes
seloo35- ddrutility (Linux)
Ddrutility is meant to be a compliment to gnuddrescue. It is a LINUX based set of utilities to help with hard drive data rescue. However, it is no longer supported.
The tool and source code is released under the GNU General Public License version 3.0 (GPLv3).
Features
- Find what files are related to the bad sectors using a ddrescue logfile (old and slow)
- Special NTFS utility to find files related to bad sectors (fast)
- Create a domain logfile to use with ddrescue to only recover the used portion of an NTFS partition
- Create a domain logfile to use with ddrescue to focus on recovering the MFT of an NTFS partition
- Perform some advanced disk read functions
dlong50036- Previous Version File Recoverer (Windows)
This free app enables you to recover prebious versions of any files on MS Windows.
larrylaca37- RAWImaging (Linux)
Forensic (but not only) graphical frontend to work with binary images (RAW) of media in GNU/Linux. These images are universal and can be installed using both standard operating systems and popular forensic software such as Encase, Sleuthkit/Autopsy, etc. in all operating systems).
The idea of the project is to implement a fast, convenient and safe making of legal copies and manipulating with images, by means of GNU/Linux, without the need for expensive hardware write lock on the media, it is necessary in the existing solutions under Windows. Also the program can be used as a last chance to rescue data from a dying media by software.
Features
- The interface is designed in such a way as to minimize the possibility of data loss when used as a result of user's error or hardware failure. In this case the program is transparent to those who used to work manually on the command line.
- Copy the contents of the hard disk image file by means of a popular tool dd_rescue, which allows to obtain a copy of even heavily damaged media.
- Automatic resume after the break up, for example, in case of loss of a disk or hardware failure. This further increases the chance to make a copy of the damaged disk in case of degradation during the second reading, or just save time.
- Calculation MD5 and SHA-1 checksum of the image captured.
- Ability to deploy the image file on a physical medium. This allows the drive to return the modified data to its original state, run the OS from the image file on a physical PC, completely transfer the data to other media, etc.
- Easy to mount and unmount partitions with data of image file.
- The program can be easily integrated into the Live CD.
- Available build for qt and gtk both.
38- SeqBox (Not a recovery tool)
This is not a data recovery tool rather than a single file container/archive that can be reconstructed even after total loss of file system structures.
An SBX container exists both as a normal file in a mounted file system, and as a collection of recognizable blocks at a lower level.
SBX blocks have a size sub-multiple/equal to that of a sector, so they can survive any level of fragmentation. Each block have a minimal header that include a unique file identifier, block sequence number, checksum, version. Additional, non critical info/metadata are contained in block 0 (like name, file size, crypto-hash, other attributes, etc.).
If disaster strikes, recovery can be performed simply scanning a volume/image, reading sector sized slices and checking blocks signatures and then CRCs to detect valid SBX blocks. Then the blocks can be grouped by UIDs, sorted by sequence number and reassembled to form the original SeqBox containers.
It's also possible and entirely transparent to keep multiple copies of a container, in the same or different media, to increase the chances of recoverability. In case of corrupted blocks, all the good ones can be collected and reassembled from all available sources.
The UID can be anything, as long as it's unique for the specific application. It could be random generated (probably the most common option), or a hash of the file content, or a simple sequence, etc.
Overhead is minimal: for SBX v1 is 16B/512B (+1 optional 512B block), or < 3.5%.
Platforms: Windows, Linux, and macOS.
MarcoPon39- ntfstool
NTFSTool is a forensic tool focused on NTFS volumes. It supports reading partition info (MBR, partition table, VBR) but also information on Master File Table, Bitlocker encrypted volume, EFS encrypted files, USN journal and more.
Features
- NTFS forensics
- Bitlocker support
- EFS support
- USN Journal analysis
- Shell support
thewhiteninja40- BlockHashLoc
BlockHashLoc enables file recovery even after total loss of File System structures or when the original FS used is unknown. By maintaining a parallel BHL file with a list of crypto-hashes of all the blocks, it is possible to rebuild the original file by comparing the saved hashes with the calculated hashes of blocks from a disk image/volume. Adequately sized blocks allow for file recovery regardless of the FS used, FS integrity, or fragmentation level.
MarcoPon41- Deleted files recovery
This is a console utility that recovers lost files of reasonable size by scanning a disk image file and identifying file formats based on their headers. The utility assumes lost files are up to 50 MB in size.
drywet42- dcfldd
dcfldd is an open-source free modified version of GNU dd. The major features added are:
- Hashing on-the-fly: dcfldd can hash the input data as it is being transferred, helping to ensure data integrity.
- Status output: dcfldd can update the user of its progress in terms of the amount of data transferred and how much longer operation will take.
- Flexible disk wipes: dcfldd can be used to wipe disks quickly and with a known pattern if desired.
- Image/wipe verify: dcfldd can verify that a target drive is a bit-for-bit match of the specified input file or pattern.
- Multiple outputs: dcfldd can output to multiple files or disks at the same time.
- Split output: dcfldd can split output to multiple files with more configurability than the split command.
- Piped output and logs: dcfldd can send all its log data and output to commands as well as files natively.
dcfldd was originally created by Nicholas Harbour from the DoD Computer Forensics Laboratory (DCFL). Nick Harbour still maintaining the package, although he was no longer affiliated with the DCFL.
Nowadays, dcfldd is maintained by volunteers.
resurrecting-open-source-projects43- Undark (SQLite)
Undark is a tool that will go through your entire SQLite database file and dump out all rows of data it finds still intact ( both current and deleted rows ). Undark does not differentiate between current and deleted data. The output of Undark is plain text CSV format.
mlt44- fuserescue
This is a free Libre CLI tool to recover only the parts of a disk accessed and not yet recovered. It uses the same mapfile format as ddrescue to store which parts have already been recovered and which parts failed. Fuse is used to mount a virtual file. Any read operation on that file will either take the already recovered data from the image file, or try to recover the data if data recovery has been enabled.
Conclusion
In summary, data recovery is an important process for retrieving lost or deleted data from a storage device. There are many different data and file recovery tools available, including open-source options.
However, data recovery can be challenging, especially when dealing with physically damaged storage devices or encrypted files.
