Practise a recovery and a restore

You will lose some photos on purpose, get them back with DiskRescue, then set up a backup and prove it works by restoring from it. Doing this once, calmly, on a stick that does not matter, is the best preparation for the day it does.

Level: beginner · Time: 30–60 minutes · Before this: How storage works, Backups that work and Recovering lost files

What you need

• A spare USB stick or SD card that you own and do not need. A small one (1 to 32 GB) is best. Copy anything you want to keep off it first. Use a stick or card, not an SSD: deleted files on an SSD are usually erased by the drive itself (TRIM), so there would be nothing to practise on.
• 5 to 10 photos from a phone or camera (JPEG files), as copies, never your only copies. Pick ones you would not mind someone else seeing, in case the stick is lost.
• DiskRescue and Delta View installed on your computer (Linux or Windows).
• For the backup part, either CloudDrop with a cloud account, or an external disk for a manual plan.
• Free space on your computer of at least the size of the stick plus the photos: the image of the stick needs as much space as the whole stick.

The commands below are for Linux. On Windows, use File Explorer for the same steps; every app step is the same.

Only on a drive you own

Practise only on a stick or card that is yours and holds nothing you need. Never point a recovery tool at someone else's drive without their permission, and never pick the disk your computer runs from.

Part 1: prepare the originals

1. Make a lab folder with the original photos.

   mkdir -p ~/lab/originals

   Copy your 5 to 10 photos into ~/lab/originals. This folder is the truth you compare everything against, so do not change it during the lab.

2. Record a checksum for each photo.

   cd ~/lab/originals
   sha256sum * > ~/lab/originals.sha256
   cat ~/lab/originals.sha256

   Expected: one line per photo, a 64-character checksum then the file name.

3. Plug in the stick and identify it.

   lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS

   Expected: a new disk, such as sdb, with a partition such as sdb1, a size that matches the stick, vfat (FAT32) or exfat in FSTYPE, and a mount point under /media/. Note the partition name; you need it in Part 2. If the size does not match your stick, stop and look again.

4. Copy the photos onto the stick, into a folder named lab-photos.

   Expected: open one photo from the stick and it shows normally.

Part 2: lose them

1. Delete the lab-photos folder from the stick permanently.

   In the Linux Files app, select it and press Shift + Delete, then confirm. A plain Delete would only move it to a hidden Trash folder on the stick. On Windows, deleting from a USB stick usually skips the Recycle Bin and asks you to confirm a permanent delete.

   Expected: the stick no longer shows lab-photos, and the Trash is empty.

2. Follow the first rule: stop using the stick.

   Do not copy anything onto it. Take it out of use with Unmount in your file manager, not "Eject" or "Safely remove", which disconnect the drive. On Linux you can also unmount from a terminal, using the partition name from Part 1:

   udisksctl unmount -b /dev/sdb1

   Expected: the stick is no longer mounted (udisksctl prints Unmounted /dev/sdb1.) but stays plugged in. If you cannot unmount it, carry on: DiskRescue's safety checks tell you what to do in Part 3.

Part 3: recover with DiskRescue

Before you start, read DiskRescue's rules in Before you start. In short: stop using the drive, do not let the computer repair or format it, never save recovered files onto the drive you are rescuing, have enough free space on the other disk, and copy a failing drive first. DiskRescue only reads the drive.

1. Open DiskRescue and select the stick.

   The Rescue from a drive page lists the drives it found. Find your stick by its name and size; it should carry the Removable tag. The disk your computer runs from is marked as such: do not pick it. Select Rescue on the stick.

2. Answer What to recover.

   Under What should DiskRescue look for?, keep Photos (the other defaults can stay). Under Which files?, keep Deleted files and files that are still there (recommended). Select Next.

3. Answer Where to save.

   Under Save recovered files to, select Choose folder... and pick a new folder ~/lab/recovered on your computer's disk, a different drive from the stick.

   Leave Copy the drive to an image first (recommended for failing drives) on. The stick is healthy, so you could turn it off, but making the image is the safe workflow you would use on a failing drive, and it lets you search again later without the stick. Put the Image file in ~/lab. DiskRescue shows the free space and warns if there may not be enough room. Select Next.

4. Review and start.

   Check Your choices and read Safety checks. If a check shows a problem, follow its What to do text and select Check again. The ones you are likely to meet:

   Message	What to do
   The drive is in use by the system (mounted)	Unmount it in your file manager and select Check again
   DiskRescue needs administrator rights to read this drive	Select Copy with administrator rights (Linux) or Restart as administrator (Windows)
   That place is on the drive being rescued	Choose a folder on another disk

   When the page shows Ready to start, select Start rescue.

   Expected: the rescue runs Copying the drive to an image file, then Finding your photos and videos. The map fills with copied parts. A small, healthy stick takes a few minutes.

5. Look at what came back.

   When the page shows Rescue finished, select See your recovered files. On the Results page, select the Deleted filter, then a thumbnail to see its details. Select Open the folder to see the files on disk.

   Expected: your photos, tagged Deleted and, for a healthy stick, Recovered, intact. In the folder, look in deleted/ first, then in carved/. Files in carved/ were found by searching the raw data and have lost their names, like f00002c41000.jpg. Repair and notes in the details panel may say that DiskRescue restored the first letter of a deleted file's name.

6. Prove the recovered photos are the originals.

   Because names may have changed, compare contents rather than names. List the checksum of every JPEG in both folders, sorted so that identical files sit next to each other:

   find ~/lab/originals ~/lab/recovered -type f -iname '*.jpg' -exec sha256sum {} + | sort

   Expected: each checksum appears at least twice, once for the original and once for a recovered file:

   4a8d8134f29b…  /home/you/lab/originals/IMG_0002.jpg
   4a8d8134f29b…  /home/you/lab/recovered/deleted/…/IMG_0002.jpg
   63c1dd951ffe…  /home/you/lab/originals/IMG_0001.jpg
   63c1dd951ffe…  /home/you/lab/recovered/deleted/…/_MG_0001.jpg

   A checksum that appears only once, next to an original, is a photo that did not come back intact. If the names did survive, you can also compare ~/lab/originals with the folder of photos under deleted/ in Delta View, as in Part 4.

Part 4: back up and test a restore

Now make sure the next loss is a restore, not a rescue. Choose plan A or plan B.

1. Set up the backup.

   Plan A, CloudDrop. If CloudDrop is not set up yet, follow the beginner guide. Then make a folder lab-backup inside your CloudDrop folder (~/CloudDrop on Linux, %USERPROFILE%\CloudDrop on Windows) and copy the photos from ~/lab/originals into it.

   Expected: the Home page shows progress and then Up to date. On the Files page, each photo shows Uploaded. Select one and choose Open in Google Drive (or look in your cloud's own website) to see the cloud copy.

   Plan B, by hand. Copy ~/lab/originals to an external disk, as lab-backup. Then write your real 3-2-1 plan on paper: what you back up, the two other places, and how often. Unplug the disk afterwards.

2. Do a test restore.

   Plan A. On the CloudDrop Files page, select the lab-backup folder and select Free Up Space. Read the Free up space? message and confirm. CloudDrop checks that the cloud holds an identical copy, then removes the local copies; the photos show Cloud-only, and the folder itself stays. Now select the folder again and choose Download.

   Plan B. Plug the disk back in and copy lab-backup from it to a new folder, ~/lab/restored. Never restore over the original.

   Expected: the photos are back on your computer, in lab-backup (plan A) or ~/lab/restored (plan B).

3. Compare the restored folder with the originals in Delta View.

   Open Delta View and select Folders. Set Left to ~/lab/originals and Right to the restored folder: ~/CloudDrop/lab-backup for plan A, ~/lab/restored for plan B. Make sure Quick compare in the toolbar is off, so DeltaView reads the file contents instead of trusting size and date. Select Compare.

   Expected: the view says "Folders are identical". Select All to see every file counted as identical. Any modified, left only or right only entry means the restore is not a perfect copy: find out why before you trust this backup.

Break it, try it

Each of these takes five minutes and teaches one lesson by experience.

Break rule 1: overwrite before you recover. Copy the photos onto the stick again, delete them permanently as in Part 2, then copy a large file, such as a video or a big folder, onto the stick until it is nearly full. Now rescue the stick again, into a new folder ~/lab/recovered-2 with a new image file name. Compare the result with your first rescue: expect fewer photos, some tagged Damaged or Has unreadable parts, or none at all. Those blocks were overwritten. This is why the first rule comes first.

Search the image again, without the stick. Unplug the stick. In DiskRescue, open Recover from an image file, select Choose file... and pick the image file from Part 3. If its map is next to it, DiskRescue shows Progress map found. Choose Every kind of file this time and compare what comes back. Recovering from an image needs no administrator rights. See Recover from an image file.

Damage a photo and repair it (Linux). Make a cut-off copy of one photo, about a third of its size. Check the size first with ls -l, then, for a 3 MB photo:

head -c 1000000 ~/lab/originals/IMG_0001.jpg > ~/lab/cut.jpg

Open cut.jpg: the bottom of the picture is grey or missing, or it will not open. In DiskRescue, open Repair photos & videos, add cut.jpg with Add files..., choose a folder under Save repaired copies to, and select Repair. Expect partly repaired: the copy opens, but the missing part stays grey. A repair cannot bring back data that is not in the file. Your cut.jpg itself is not changed. See Repair photos and videos.

Delete a file in CloudDrop. Delete one photo from lab-backup in your CloudDrop folder. On the Files page it stays listed as Cloud-only: CloudDrop never deletes in the cloud. Select it and choose Download to bring it back. Then compare the folders in Delta View again.

See a sync delete before it happens. Copy ~/lab/originals to ~/lab/mirror-test and add a text file to mirror-test. In Delta View, compare Left ~/lab/originals with Right ~/lab/mirror-test, select Synchronize… and choose Mirror left → right. The preview lists a Delete on step for the text file: a mirror makes the right side match the left, deletions included. Close the dialog without synchronizing, or synchronize to watch the file go. It does not go to a wastebasket. See Synchronize folders.

Clean up

1. Delete the lab folders on your computer when you are done: ~/lab/recovered, ~/lab/recovered-2, ~/lab/mirror-test, ~/lab/cut.jpg, ~/lab/restored and the image file, which is as large as the stick. The recovered folders hold copies of your photos.

2. Plan A: delete lab-backup from your CloudDrop folder if you do not want to keep it. Remember that this only removes the local copy: CloudDrop keeps it in the cloud and lists it as cloud-only. To remove it from the cloud, delete it in your cloud's own website or app.

3. Plan B: delete lab-backup from the external disk if you do not need it.

4. The stick still holds traces of the photos you deleted: the lab proved it. Before you give it away or reuse it for something private, overwrite it. On Windows, format it with Quick Format unticked. On Linux, use the Disks app's format option with erasing turned on. Check the drive's name and size twice before you format.

5. Delete ~/lab/originals and ~/lab/originals.sha256 too. They were copies; your photos stay wherever you copied them from.

Check yourself

QuizPractise a recovery and a restore

Question 1 of 6

Why does the lab use a USB stick or SD card rather than an SSD?

Score: 0

What you learned

• Deleted photos on a stick or card stay recoverable until something overwrites them, and writing to the drive is what destroys them.
• DiskRescue reads the drive, never writes to it, and saves to another disk, with an image you can search again.
• Checksums and a folder comparison prove a recovered or restored file is the original, whatever its name.
• A backup counts only after a test restore, compared with the original.
• A mirror sync deletes, and a deleted file on a stick needs overwriting before the stick is given away.

Next steps

• Files, backups and recovery: back to the track
• Browse your results in DiskRescue
• Free up space safely with CloudDrop