How to recover lost mp3's for free

Glenn Waller May 2010
How to recover lost mp3's for free.
suitable for one user system users, administrators and technicians
time to do? 45Min approx.
programs used,
GNU/Linux (Mandriva 2010.1) Kernel 2.6.32.3-2mnb_x86_64
Photorec partition data recovery tool
find to list and sort files
EasyTag to recover file names from tags

You'll need root access to use Photorec, su or sudo to root in your shell, type in the root password if required. I think it's because of access to raw (unmounted) file system data. The files will be written as (user and group) root, so we fix the permission changes during this tutorial (you need root access to do this too) back to user-name group and user before doing too much more. This way we can use user-land instead of having to stay as root for long periods of time.

Scenario
Msec was deleting unowned files in the /home partition

moved mp3's off etx3 partition to fat32 partition to share whilst working within windows xp land
and out of Msec's long hands. Eventually I had no access to the files permissions from
GNU/Linux. During previous attempts to fix the permission problem, I had copied the data off the
disk, changed the attributes under ext4 (this time), formatted the disk and copied the...data.....ack.
anyway, it didn't work.

The task begins.
Being a long time advocate for Photorec in the past, (recovering music from old damaged cdroms) I knew I could (probably) almost certainly recover the music files from the ext4 formatted partition. There were also a lot of other files on there too, like a backup of HalfLife2 CC:S downloads and games, maps, etc, about 8.5 to 12 gig, and much more.
First things first, you need a partition equal to or greater than in size of the partition you wish to recover. Next you need to run Photorec from the directory from where you wish to store the files Photorec finds. So, make a directory on the partition you are using for the recovered files and cd to the recovery directory, like this (you'll need to change the absolute address to match your folder names)
[code]
mkdir /home/glenn/storage/recovery
cd /home/glenn/storage/recovery

Unmount the drive the data is being recovered from, (/home/glenn/stuff in my case)

/etc/fstab...
# Entry for /dev/sdb9 :
UUID=ef444615-fcc7-438d-8711-57fc1571b4c1 /home/glenn/stuff ext4 relatime 1 2

check /etc/fstab in a text file reader, like cat. # Entry for /dev/sdb9 :

sudo umount /dev/sdb9

If you can't unmount the drive you may be able to use a bootable GNU/Linux flash-stick, like slax and knoppix live distributions.

I pulled up Photorec on the screen, cli mode, type 'photorec' at the prompt. (reminder, you need to be root)
What is displayed on the screen is a list of physical drives on the system, navigate with the cursor keys and select(hit enter to continue) the drive the data you want to recover may be found (Last Know Address). Make sure you highlight the drive selection, with the up and down arrows and select continue or abort with the left or right arrows, to save unintentional aborting.
The next screen list some details about the drive, continue to the next section about the partition table types, I have a PC and selected the Intel platform. (please don't ask me about the other partition types, I don't know) Now here it gets to the partition level, a note of warning...
Be Careful Here it's easy to begin the recovery of ALL the data on the partition, but I only want songs mp3, wav, ogg, and pictures bmp, jpg, gif, png.
So if you only want certain file types, select 'options' down near the bottom of the partition list (we'll select the partition after we set the file extension filter)
Here you can set the paranoia mode, low ram, and other setting better suited to Forensic file recovery. I usually leave this at the defaults, we just want to do a late backup.
Hit enter to 'quit'.
Scroll across to the 'File Opt' tab and enter into the extension list. Using the arrow keys and space bar to mark the grid for the types you want Photorec to search for.
“Press s for default selection, b to save the settings”
Saving this creates a file that may be called again when you next use Photorec (as root).
Once you had a good search through the list and marked the file types you want return to the partition page and use the arrows to scroll down to the partition you want, in my case .../sdb9.
Photorec is now ready to start, if you are ready highlight the 'search' function and hit enter. You should see a list of file types appear on the screen, they appear as they are found, so don't abort if you don't see the file types you selected in 'File Opt' as soon as it starts. It should also display how long it will take to complete the search. The files still remain on the old partition too in case you need to search harder. Photorec took 21 min to scan 54gig of data spread over a 73Gb partition. And save them neatly in the present working directory (/home/glenn/storage/recovery)

This is the end screen of a “second scan” without 'File Opt' being edited, approx 28minutes

PhotoRec 6.11, Data Recovery Utility, April 2009
Christophe GRENIER
http://www.cgsecurity.org

Disk /dev/sdb - 250 GB / 232 GiB (RO) - ATA WDC WD2500AAKS-0
Partition Start End Size in sectors
9 L Linux 20859 1 1 30400 254 63 153292167 [stuff]


17647 files saved in /home/glenn/storage/recovery/recup_dir directory.
Recovery completed.
txt: 8728 recovered
mp3: 3345 recovered
mpg: 2351 recovered
gif: 1513 recovered
jpg: 944 recovered
flv: 524 recovered
mov: 91 recovered
png: 77 recovered
ogg: 60 recovered
gpg: 6 recovered
others: 8 recovered

you need to quit each page until you are back in the bare shell.

Post-recovery clean-up
Prior to sorting and renaming, and the last job we need to do as root, is change the file permissions to my user and group. In my case, user glenn and group glenn with chown and chmod to make them readable,writeable and executable.
[code]
sudo chown -hR glenn:glenn /home/glenn/storage/recovery
#change user and group to glenn
sudo chmod -R 775 /home/glenn/storage/recovery
#make writeable by a program and user

…..type exit and hit enter to quit the shell as root.

Using find to list and sort files
ref. Shawn Hermans
I wanted to copy all the mp3 files to a directory and also filter off the files I thought would be too small to be useful as an mp3 with any quality, I set it for 2Mb 2048kb's and also made a dir small for the small files that I would not bother renaming.
[code]
mkdir /home/glenn/storage/recovery/mp3
mkdir /home/glenn/storage/recovery/small


find does not use the standard sequence off directives in GNU/Linux
use 'man find' and 'man xargs' to get the lowdown on these tools. Type q to quit at any time from the man page.

Excerpt from man find...find uses 'find source arguments expression destination'...

NON-BUGS
$ find . -name *.c -print
find: paths must precede expression
Usage: find [-H] [-L] [-P] [-Olevel] [-D help|tree|search|stat|rates|opt|exec] [path...] [expression]

This happens because *.c has been expanded by the shell resulting in find actually receiving a
command line like this:

find . -name bigram.c code.c frcode.c locate.c -print

That command is of course not going to work. Instead of doing things this way, you should
enclose the pattern in quotes or escape the wildcard:
$ find . -name '*.c' -print
$ find . -name \*.c -print

The xargs manpage reveals more on how the find command works....
man xargs excerpt...

EXAMPLES
find /tmp -name core -type f -print | xargs /bin/rm -f

Find files named core in or below the directory /tmp and delete them. Note that this will
work incorrectly if there are any filenames containing newlines or spaces.

find /tmp -name core -type f -print0 | xargs -0 /bin/rm -f

Find files named core in or below the directory /tmp and delete them, processing filenames in
such a way that file or directory names containing spaces or newlines are correctly handled.

find /tmp -depth -name core -type f -delete

Find files named core in or below the directory /tmp and delete them, but more efficiently
than in the previous example (because we avoid the need to use fork(2) and exec(2) to launch
rm and we don't need the extra xargs process).

Oh, and the i means [-i[replace-str]] Replace string


Because of type setting and formatting of text I tried to use a back-slash (\) here to continue code lines, It's not very effective in the my zshell, bash may be different. You may need to copy the lines to a text editor like kate to edit/join them up, just one space is enough, and no spaces at the end. ;-)

find /home/glenn/storage/recovery/ -name "*.mp3" | xargs -i mv {} /home/glenn/storage/recovery/mp3/
find /home/glenn/storage/recovery/ -name "*.ogg" | xargs -i mv {} /home/glenn/storage/recovery/mp3/
find /home/glenn/storage/recovery/ -name "*.wav" | xargs -i mv {} /home/glenn/storage/recovery/mp3/

This code moves files from the mp3 directory that are less than 2048kb (2Mb) Most 2.5 to 3 minute mp3s are about +2.5Mb

minimum file size...

find /home/glenn/storage/recovery/mp3/ -name "*.mp3" -size -2048k | xargs -i mv {} /home/glenn/storage/recovery/small/
find /home/glenn/storage/recovery/mp3/ -name "*.ogg" -size -2048k | xargs -i mv {} /home/glenn/storage/recovery/small/
find /home/glenn/storage/recovery/mp3/ -name "*.wav" -size -2048k | xargs -i mv {} /home/glenn/storage/recovery/small/

Now, we have sorted the files we want to work with from the files we don't want to bother with.

Next we want to get most of our file names back, For this I found EasyTag, a a tag search like mp3info with a very handy bulk scanning and renaming tool with a graphical user interface.

Example of reading data tags with mp3info...

mp3info -F /home/glenn/storage/recovery/mp3/f81018974.mp3
File: /home/glenn/storage/recovery/mp3/f81018974.mp3
Title: The River Track: 6
Artist: Bruce Springsteen & The E Stre
Album: Live In New York City (Disc 1) Year: 2001
Comment: Genre: Other [12]


Retrieving Filenames
ref. http://easytag.sourceforge.net/ EasyTag 2.1.6
http://en.wikipedia.org/wiki/EasyTag

Using Mandriva 'urpmi easytag' will install the package.

Dependencies....
Checking the sourceforge site for EasyTag, the dependent libraries are listed as such

The program depends on the following libraries:
GTK 2.4,
id3lib to handle MP3 files,
libogg,
libvorbis for Ogg Vorbis files,
libFLAC (with libogg and libvorbis) for FLAC Vorbis files,
mpeg4ip for MP4 files.


urpmi installed the package EasyTag with no questions, but due to previous experience I went ahead and checked to see if I could find them. I did not find them all, some of the library names have changed and some were plain missing. I used a combination of locate, urpmq and urpmf to search for the libs and subsequent dependants. And also “Install and Remove Software” to see the info on the package I could not find. Here are my findings... an explanation follows...


EasyTag deps....

#GTK 2.4,
#id3lib to handle MP3 files, (optional, except to write ID3v2.3 tags in MP3 files),
#libogg,
#libvorbis forsupport for Ogg Vorbis and flac files,
#libFLAC (with libogg and libvorbis) support for FLAC Vorbis files,
#mpeg4ip support MP4/ACC file
#libid3tag(required)
#libxcb-xlib
#lib64amrnb3
#lib64arts1
#lib64mpeg4ip0
#lib64xvid4
#end deps list (may not be complete)glib-devel?
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

libs
# libavcodec.so.51
#locate libavcodec.so.5
#copy and rename
#/usr/lib/libavcodec.so.52
#/usr/lib/libavcodec.so.52.66.0
#copy and rename
sudo cp /usr/lib64/libavcodec.so.52 /usr/lib64/libavcodec.so.51
#/usr/lib64/libavcodec.so.52.66.0
# package-lib64ffmpeg52

# libdirect-1.0.so.0
#copy and rename
#locate libdirect-1
#/usr/lib64/libdirect-1.2.so.0
#/usr/lib64/libdirect-1.2.so.0.8.0
sudo cp /usr/lib64/libdirect-1.4.so.0 /usr/lib64/libdirect-1.0.so.0
#/usr/lib64/libdirect-1.4.so.0.3.0

# package-lib64directfb1.4, install previous versions of the 1.4 packages first.
#because the latest ver of the package only has the shared files, not the libs.
#libdirectfb-1.0.so.0 locate libdirectfb-1
#copy and rename
sudo cp /usr/lib64/libdirectfb-1.4.so.0 /usr/lib64/libdirectfb-1.0.so.0 #/usr/lib64/libdirectfb-1.2.so.0.8.0
#/usr/lib64/libdirectfb-1.4.so.0
#/usr/lib64/libdirectfb-1.4.so.0.3.0

# libfusion-1.0.so.0
#locate libfusion-1
sudo cp /usr/lib64/libfusion-1.2.so.0 /usr/lib64/libfusion-1.0.so.0
#/usr/lib64/libfusion-1.2.so.0.8.0
#/usr/lib64/libfusion-1.4.so.0
#/usr/lib64/libfusion-1.4.so.0.3.0

# libmp4v2.so.0
#locate libmp4v2
#copy and rename
sudo cp /usr/lib64/libmp4v2.so.1 /usr/lib64/libmp4v2.so.0
#/usr/lib64/libmp4v2.so.1.9.1

# libxcb-xlib.so.0, libxcb-res0 replaces this package
#copy and rename
#locate libxcb-res
#/usr/lib64/libxcb-res.la
#/usr/lib64/libxcb-res.so
sudo cp /usr/lib64/libxcb-res.so.0 /usr/lib64/libxcb-xlib.so.0
#/usr/lib64/libxcb-res.so.0.0.0



The majority of the problem libraries were version labels, except one that I found had a replacement with a new name, so effectively these libs just needed renaming to allow the program EasyTag to work. I've left the required lines uncommented(#). You will need root access to change these files. I thought about linking the files rather than copying them with new names and decided that at the rate of development with Mandriva and GNU/Linux in general it would make little difference to my system, but feel free to experiment (ln and ln -s instead of cp) This way, at least, the system should be able to find and use the libs when called by the program.
In short...


sudo cp /usr/lib64/libavcodec.so.52 /usr/lib64/libavcodec.so.51
sudo cp /usr/lib64/libdirect-1.4.so.0 /usr/lib64/libdirect-1.0.so.0
sudo cp /usr/lib64/libdirectfb-1.4.so.0 /usr/lib64/libdirectfb-1.0.so.0
sudo cp /usr/lib64/libfusion-1.2.so.0 /usr/lib64/libfusion-1.0.so.0
sudo cp /usr/lib64/libmp4v2.so.1 /usr/lib64/libmp4v2.so.0
sudo cp /usr/lib64/libxcb-res.so.0 /usr/lib64/libxcb-xlib.so.0


Using the EasyTag program
When first started the program offers little until a directory has been scanned. Make sure the directory is writeable by the user (you) and the select the folder in the browser section of the window. EasyTag will now scan the files for the tag information of all the available files in that directory, don't worry it won't do anything else yet. Now the buttons for options appear usable. The directory I used (/home/glenn/storage/recovery/mp3) has 2775 files that were recovered from the formatted disk, some of which were deleted by MSEC.
Go to the 'scanner' menu and select 'Rename file/s and directory', this shows a dialogue where you can type or select from the drop down list what tags to search for (and in what order) and eventually use for renaming. Check the website for details. Also the settings for the scanner and re-namer are available here too, and by selecting the 'Scanner Options' icon, the settings panel appears. I have not changed much here, except to replace the %20 strings with a space. A helpful information comment appears when the mouse cursor is over an option to help understanding. I have chosen create directory-name/file-name, %a - %b/%n - %t. (%a = Artist, %b = Album, %n = Track number, %t = Title) On revision, %a/%b/%n-%t, may suit better, artist/album/track-filename. ;-) That's what I use now. :-)
This process takes much longer, but is required to read the tags from the files. Once it has finished, do not go to the 'file' menu and 'select all', It Crashes the program, Instead go to the 'file' menu and select 'sort by tag', 'browse results by artist'. Select a group of files by one artist then select 'save'. This should rename the files and create directories for the files, from the tags. Repeat this action for all of the individual artists. That tool care of 80% of my files and saved me a lot of time. To clean up the rest (about 600 files) I used Kde's Amarok. Here I listened to the files and renamed them, amazingly, Amarok had some of the tags right before I started. Cool, more time saved.
I'm still sorting through the list, many of the files are from Hl2/CS:S background sounds.

I hope this helps you too. :-)

Cheers and Regards Glenn