Anatomy of a hard drive: what really goes on inside your PC's storage

Hold down Alt+SysRq (usually top-right on the keyboard) and then press the following keys in order:

R (get keyboard control back), E (terminate processes), I (kill errant processes), S (sync data to disks), U (unmount drives), and B (reboot).

What's in a filesystem?

A hard drive without a filesystem is just a jumble of data. The filesystem helps the operating system to make sense of the disk - finding out where files start, where they end, and which directories they belong to.

In a simple filesystem, such as DOS FAT, you have a table in the first few sectors, describing where the files are located. Every file has an entry in this table (which is why most filesystems have a limit on the number of files), containing its name, the time it was created, how big it is in bytes, which sector it starts at, and so forth.

By far the most common filesystem in the Linux world is ext4, which is an excellent, reliable, general purpose filesystem for hard drives.

For a while, there was some competition in the Linux world in the form of ReiserFS, an innovative filesystem whose development suffered a setback when the lead developer was charged with and later convicted of the murder of his wife…

There are other filesystems worth being aware of, typically suited to more specialised tasks than a regular desktop PC.

ZFS, for instance, provides great performance and reliability across multiple disks, as covered in our FreeNAS tutorial on page 90.

Then there's LogFS, designed to be used on flash drives (which internally work completely differently to spinning hard drives, and therefore can benefit from a dedicated filesystem).

It's interesting to note that with all the advanced filesystems in use today, on both Linux and Windows, typical USB flash keys come pre-formatted with FAT32 (and its limitations). It feels a little bit strange to use such backward technology today, but it does mean that these keys are compatible with virtually everything.

Cut out and keep: recover lost files

Making backups is the single most important thing you can do for your data. And the second thing is making even more backups.

But despite good intentions, we can all make mistakes and accidentally delete files. Due to the way modern filesystems work - shuffling files around on the drive to avoid fragmentation issues - file recovery software isn't always 100% successful. But there's hope.

First, get hold of a rescue distro with Photorec installed. One of the best is Recovery Is Possible, aka RIP, a mini distro designed for fixing damaged Linux installations.

Burn it to a CD-R and keep it handy near your PC for emergencies.

When you want to recover an accidentally deleted file, shut down the machine and boot RIP. In a terminal, enter 'photorec' and you'll be prompted to select the drive and partition that contained the file.

Then you'll be asked for the filesystem type, and whether to scan the whole drive or just space marked as empty (the latter is quicker). Finally, you'll be asked for a location to store recovered files.

Afterwards, recoverable files will be placed in recup_dir folders, followed by a number. You won't have the original filenames, so an image such as kitten.jpg could become f0015362.jpg.

If you have lots of files, you'll have to look at them and rename them manually. But at least you have the data back...

Photorec

> During the recovery process, Photorec shows which file types it has identified in searching through the raw disk data.