Skip to content

Home

Jump to bottom
NK edited this page Aug 14, 2026 · 2 revisions

GHOST RECOVER

Linux data recovery engine — recover deleted files, carve lost photos and documents from RAW disks, reassemble RAID arrays, clone failing hard drives and repair damaged filesystems. A read-only-first, open-source data recovery tool with a web interface, a CLI and an HTTP API.
License MIT
Language C++17
Platform Linux
RAM 1 GiB minimum
Formats 44 filesystems, 315 carver signatures across 14 categories

Features

  • Filesystem & deleted-file recovery — walks the raw metadata of 44 filesystems (ext2/3/4, XFS, Btrfs, NTFS, FAT32, exFAT, APFS, HFS+, ISO 9660, UDF and more) to reconstruct full directory paths and find deleted files — from the journal, orphan inodes, directory slack, MFT slack and FAT1/FAT2 differencing.
  • RAW disk carving — recovers 315 file formats across 14 categories (JPEG, PNG, RAW photos, videos, documents, archives, email, databases and more) with a single Aho-Corasick pass, structural length validation and content-hash deduplication.
  • RAID recovery — reassembles RAID 0, RAID 1, RAID 5, RAID 6, RAID 10 and linear arrays from md superblocks or blind geometry detection, and rebuilds a missing member from parity.
  • Hard drive imaging — ddrescue-style cloning of failing disks with a resumable map file and bad-sector retries.
  • Filesystem repair — restores ext/FAT/NTFS boot regions and GPT headers from backups, always a dry run until you say apply.
  • Runs on low-end hardware — RAM-aware candidate limits, caches and thread pools; jobs run one at a time in a fair queue with honest byte/candidate-based progress.

Everything is read-only unless you explicitly start the engine with --allow-writes. GHOST RECOVER refuses to write recovered data back onto the disk it came from.

Quick start

git clone https://github.com/nkbeast/ghost-recover
cd ghost-recover
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j

./build/ghost_recover            # opens the web interface in a browser
./build/ghost_recover --help     # command-line usage

Reading a physical disk needs root. The interface offers to unlock locked disks — see Elevation and security.

Documentation

Clone this wiki locally