Data loss is something that all PC users have to face at some point in time. Whether it’s a hard disk failure or accidental deletion, we’ve all been in situations where we wish we could get our deleted data back.
Fortunately, recovering deleted files on Linux is simpler than on other operating systems. You can easily recover deleted files with tools like TestDisk, PhotoRec and Foremost.
Things to know before you start
Linux system provides Trash / Trash can utility for soft deleted data. So if you deleted the files using Delete on your keyboard, you can instantly get them back by going to Garbage and restore them.
However, if you deleted the files permanently using Shift + Del, you will need to recover them using one of the data recovery software available for Linux. But since different programs use different methods to recover lost data, it can take many attempts to get all deleted files on Linux.
Thankfully, even in the case of permanent deletion, the data is not lost immediately. They are hidden from the file system and will only be deleted when you overwrite them. So, the first step to recover lost data from hard disk partition is to make the partition read-only. It ensures that you don’t accidentally overwrite deleted data.
For example, if the deleted files are on the partition /dev/sdb1, you need to unmount it first and then mount it again as read-only. You can do so using the commands below. Make sure to adjust the partition name according to your system.
sudo umount /dev/sdb1
sudo mount -o ro /dev/sdb1 /media/read-only
It is also a good method to copy partitions to another drive. It will make sure you don’t lose the source partition while recovering data. You can use dd to clone Linux partitions. The command below copies the contents of /dev/sdb1 arrive sda1 partition of /dev/sdaanother drive.
dd if=/dev/sdb1 of=/dev/sda1 bs=1M
Recover Deleted Files on Linux Using TestDisk
TestDisk is an open source data recovery program that can effectively recover files or partitions that have been permanently deleted. It is packed with useful features and offers an easy to use interface. You can install TestDisk on Linux with the following commands:
sudo apt install testdisk
sudo yum install epel-release
sudo yum install testdisk
sudo pacman -S testdisk
Once installed, start TestDisk by opening a terminal and entering the command testdisk.
You’ll find yourself at the TestDisk interactive prompt. Use the arrow keys on your keyboard to navigate and press enter to select options. The first available option is to create a log file. Go ahead and create one.
The following screen will show a list of storage media connected to your system. Select the device that contains the deleted files. We are using /dev/sdb media for this tutorial. Choose yours accordingly and press Continue.
The next screen will prompt you to choose a partition type for your disk. Choose the correct one for your drive. Note that TestDisk will attempt to detect the correct type on its own. So if you are not sure, switch to the partition type detected by TestDisk.
You will see several options available on the following screen. The Analysis This option is useful to recover lost partitions. However, we will use High level option to recover deleted files.
Next, you will see a list of all the partitions present on your selected device. Select the partition containing your deleted data and select Rehibilitate from the bottom menu.
TestDisk will scan MFT entries for deleted files on this partition and list them here. We are looking for files picture.jpg displayed on this screen.
You can select/deselect specific files using : and all files using one. After selecting the files to recover, press OLD to copy them.
You will be prompted to choose a recovery destination. Navigate there and press OLD to save the file.
Recover Deleted Files on Linux Using PhotoRec
PhotoRec is another powerful data recovery program created by the developers of TestDisk. It was developed to recover deleted photos on Linux but has evolved into a full-fledged program of its own. You can use PhotoRec to recover all types of deleted files.
The difference between TestDisk and PhotoRec is that the latter can retrieve files even from disks that have been damaged beyond repair. It uses file signatures to detect deleted files, which makes it incredibly powerful. However, files retrieved via PhotoRec do not retain their original filenames.
You can install PhotoRec on different Linux distributions using the same commands used to install TestDisk. So if you already have TestDisk installed, you don’t need to reinstall PhotoRec. If you did not install TestDisk before, see the above and install the test disk package.
This command will start PhotoRec and take you to the start menu. The layout is similar to TestDisk and so is the navigation. You will be prompted to select the disc media. Select the correct one and press Continue.
Then you will need to select the source partition. Select the appropriate partition and select Select file from the bottom menu.
Here you can specify the file type of your deleted files. PhotoRec selects all file types by default. You can turn them all off using S and select a specific type using x. We are choosing jpg to restore our image file.
Now go back to using q and choose Search option to start file recovery on Linux.
You will then need to select the file system type. Choose Other if the source partition is not ext3/ext4.
At this step, you must specify whether to search the selected file types in the entire partition or only in the free space. We are choosing Space looks option for faster search.
The next step asks the user to select the destination folder. Make sure not to save the file on the same partition that you are scanning. Navigate to the desired location using the arrow keys and press OLD for saving.
PhotoRec will now scan the free areas and save the recovered files to the selected destination. It will save the recovered files in a folder called recup_dir.
Recover Deleted Files Using Foremost on Linux
Foremost is a free data recovery tool for Linux. It comes with a simple CLI interface. Although the software is not as interactive as TestDisk or PhotoRec, it still proves to be useful in certain situations. You can install Foremost on Linux with the following commands:
sudo apt install foremost
sudo dnf install foremost
sudo pacman -S foremost
Once installed, the software is relatively simple to use. You can list all possible options using below command:
We can recover deleted files picture.jpg using the following most important command:
foremost -v -t jpg -i /dev/sdb1 -o ~/recovery/
This command will search all lost JPG images in /dev/sdb1 and restore them to ~ / recovery. The -v flags enable detailed logging, -I specify the source partition and -o Specify the output directory.
The -t the option allows the user to specify the files to search. Foremost supports many different file types and can locate images, videos, text, and executable files. You can search for multiple extensions using a comma-separated list.
Recover Deleted Files on Linux Using Extended Features
extundelete is a data recovery program that can recover deleted files from ext3/ext4 file system. These are the file systems used by popular Linux distributions like Ubuntu. You can install except with one of the following commands:
sudo apt install extundelete
sudo yum install extundelete
sudo yay -S extundelete
Once installed, you can proceed to recover deleted files from your Linux system using the except feature. Use the command below to quickly restore a specific file. Note that the file path is relative to the root of the partition.
Next command get all files from partition /dev/sdb1. Change the partition name to match your source.
If you want to save the recovered files to a specific folder, specify it using -o Selection.
sudo extundelete -o ~/recovery --restore-all /dev/sdb1
By default, except save recovered files inside RECOVERED_FILES / subfolder.
Recover Deleted Files on Linux Using R-Linux
R-Linux is a free but not open source GUI data recovery tool for Linux. It can scan ext2/ext3/ext4 file systems to find deleted files and recover them. You can download the R-Linux binary from the R-Tools Technology website for your particular distro.
Once downloaded, install it using your package manager. Once installed, open the software by going through your applications menu. Enter the sudo password when prompted.
Now select the source partition containing the deleted files and scan it using the GUI. You can choose from different scanning methods based on your requirements.
Wait until the scan is finished to see the list of deleted files. Select the ones you need and restore them from the top menu.
Recover Deleted Files on Linux
Thanks to the plethora of high-quality data recovery programs, recovering deleted files is quite easy on Linux. You can choose any of the above tools based on the type of deleted files and your system partition configuration. However, we recommend TestDisk and PhotoRec because they provide simple and clear interactive prompts.
Since data recovery can be a nightmare for many people, you should always store backups on external devices. It will help to get back deleted data with just a few clicks.
This is why you need backup storage on external devices
About the author
https://www.makeuseof.com/tag/recover-deleted-files-from-your-linux-system/ How to Recover Deleted Files on Linux