Freedom251 › Data recovery software
deep-recover
What deep-recover is
deep-recover is a free, MIT-licensed Linux command-line utility for recovering deleted files from disk images. It accepts images from USB sticks, SD cards, hard drives, and other disks, and advises creating an image before recovery instead of working on a live device. Its default process combines filesystem-metadata recovery with raw signature carving, then removes duplicate results by content hash. The metadata engine uses optional pytsk3 support to read FAT, NTFS, and ext2/3/4 structures and can retain original filenames, sizes, and timestamps when data remains intact. Built-in carving recognizes JPG, PNG, GIF, PDF, ZIP-based formats, GZIP, BMP, MP4, SQLite, and WAV. If pytsk3 cannot be installed, carving-only mode remains available. Carving reads 8 MB chunks with overlap. Recovery cannot restore overwritten data, SSD TRIM can erase deleted data, fragmented files may be corrupted, and encryption is not defeated.
Who it suits
It suits Linux users working with disk images for learning or utility tasks. Use is limited to media you own or have explicit written authorization to examine.
What it does well
- Free MIT-licensed command-line tool
- Supports USB, SD, hard-drive, and disk images
- Metadata recovery can preserve filenames and timestamps
- Carves many common file formats
- Deduplicates results by content hash
What to know first
- Linux platform only
- Metadata engine requires optional pytsk3
- Overwritten data cannot be recovered
- Encrypted data remains unreadable without its key
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| deep-recover | MIT-licensed CLI; filesystem-metadata engine requires optional pytsk3 dependency | Free |
As github.com lists them, read 12 Oct 2026. The maker's own page has the final word.
Verdict
deep-recover offers two recovery methods and broad format carving without a license fee. Its image-focused workflow and recovery limits make it more suitable for authorized learning and utility work than production forensic operations.
Facts from deep-recover's own pages
- Authorized use
- The README says to use the tool only on media you own or have explicit written authorization to examine. · github.com, 12 Oct 2026
- Carving formats
- Built-in carving supports JPG, PNG, GIF, PDF, ZIP-based formats, GZIP, BMP, MP4, SQLite, and WAV. · github.com, 12 Oct 2026
- Encryption
- The project says it does not defeat encryption, and data recovered from an encrypted volume without its key remains unreadable ciphertext. · github.com, 12 Oct 2026
- Free plan
- Yes · github.com, 19 Sept 2026
- Input
- The CLI accepts disk image files and is intended to run against an image rather than a live mounted device. · github.com, 12 Oct 2026
- Installation
- The README gives pip installation instructions and says the metadata engine is an optional extra that requires pytsk3. · github.com, 12 Oct 2026
- License
- The repository identifies the project as MIT licensed. · github.com, 12 Oct 2026
- Limit: encryption
- The tool does not break encryption; recovered data from an encrypted volume without its key remains unreadable ciphertext. · github.com, 12 Oct 2026
- Limit: overwritten data
- Recovery only works while file data has not been overwritten, and the README says SSD TRIM can erase the recovery opportunity shortly after deletion. · github.com, 12 Oct 2026
- Limits
- Recovery depends on data not being overwritten; SSD TRIM may erase deleted data, and carving fragmented files can produce corrupted output. · github.com, 12 Oct 2026
- Maker
- The GitHub profile identifies Bernard Hamie as a full-stack engineer and cybersecurity specialist. · github.com, 12 Oct 2026
- Memory card recovery
- Yes · github.com, 19 Sept 2026
- Metadata recovery
- The metadata engine uses pytsk3 to read FAT, NTFS, and ext2/3/4 filesystem structures and can recover original filenames, sizes, and timestamps when the data remains intact. · github.com, 12 Oct 2026
- Optional dependency
- The metadata engine is optional; if pytsk3 fails to install, the tool falls back to carving-only mode. · github.com, 12 Oct 2026
- Performance
- The carving engine reads the source in 8 MB chunks with an overlap window rather than loading the entire image into memory. · github.com, 12 Oct 2026
- Purpose
- deep-recover recovers deleted files from disk images using filesystem metadata parsing and raw signature carving. · github.com, 12 Oct 2026
- Recovery engines
- It runs metadata recovery and signature carving by default, then de-duplicates results by content hash. · github.com, 12 Oct 2026
- Recovery sources
- USB sticks,SD cards,hard drive images,disk images · github.com, 19 Sept 2026
- Supported input
- The CLI accepts disk image files and advises imaging a device before recovery instead of operating on a live device. · github.com, 12 Oct 2026
- Use case
- The README describes the tool as a learning and utility project and recommends mature alternatives for production forensic work. · github.com, 12 Oct 2026
Where deep-recover stands on Freedom251
- Data recovery software#62 of 128