Recover deleted files in Linux

Sometimes we want to recover deleted from in our Linux machine, so today in this article we will discuss about the same. To recover deleted files we will use Photorec recovery tool though there are many other applications/packages available that we will discuss later. In this article we will use Ubuntu as our OS.

Photorec searches for 80 different types of files and it is part of testdisk package.

Installation:

Package required: testdisk

alok@ranjan:~$ sudo apt-get install testdisk

If we want to recover any image file the we can use the below command:

sudo photorec imagefilename

We can directly recover files from any device as well. For that we can use photorec command without any argument, which will give the menu for available devices.

Then it will ask to select the appropriate disk/media. We can use arrow key to move the cursor and Enter to select the choice.

alok@ranjan:~$ sudo photorec PhotoRec 6.11, Data Recovery Utility, April 2009 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org   PhotoRec is free software, and comes with ABSOLUTELY NO WARRANTY. Select a media (use Arrow keys, then press Enter): Disk /dev/sda - 214 GB / 200 GiB (RO) - VMware Virtual disk [Proceed ]    [  Quit  ] Note: Disk capacity must be correctly detected for a successful recovery. If a disk listed above has incorrect size, check HD jumper settings, BIOS detection, and install the latest OS patches and disk drivers.

System will ask for the partition table type used as below:

Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org PhotoRec 6.11, Data Recovery Utility, April 2009 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/sda - 214 GB / 200 GiB (RO) - VMware Virtual disk Please select the partition table type, press Enter when done. [Intel  ]  Intel/PC partition [EFI GPT]  EFI GPT partition map (Mac i386, some x86_64...) [Mac    ]  Apple partition map [None   ]  Non partitioned media [Sun    ]  Sun Solaris partition [XBox   ]  XBox partition [Return ]  Return to disk selection Note: Do NOT select 'None' for media with only a single partition. It's very rare for a drive to be 'Non-partitioned'.

I have selected Intel/PC partition as my partition type and press Enter to proceed. Then system will ask to select the partition name to recover files, if we want to search in whole disk we can select No Partition.

PhotoRec 6.11, Data Recovery Utility, April 2009 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/sda - 214 GB / 200 GiB (RO) - VMware Virtual disk      Partition                  Start        End    Size in sectors      No partition             0   0  1 26108  85 25  419430400 [Whole disk]  1 * Linux                    0  32 33 25044 159 11  402339840  2 E extended             25044 191 42 26108  52 56   17084418  5 L Linux Swap           25044 191 44 26108  52 56   17084416 [ Search ]  [Options ]  [File Opt]  [  Quit  ]                               Start file recovery

To recover lost files Photorec will ask for the filesystem type where files were stored as below:

PhotoRec 6.11, Data Recovery Utility, April 2009 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org  2 E extended             25044 191 42 26108  52 56   17084418 To recover lost files, PhotoRec need to know the filesystem type where the file were stored: [ ext2/ext3 ]  ext2/ext3/ext4 filesystem [ Other     ]  FAT/NTFS/HFS+/ReiserFS/...

In our case we have selected the ext2/ext3 as the filesystem by using the arrow key and then press Enter. The Photorec will ask for the location were recovered files will be saved. By default it will save the recovered files in home directory after pressing Y key. If we want to save the recovered files in some other location or to external drive then we can use the arrow key to select .. and hit Enter key and select the desired drive. Once we will select the desired location we can hit Enter to proceed further. 

PhotoRec 6.11, Data Recovery Utility, April 2009 Christophe GRENIER <grenier@cgsecurity.org> http://www.cgsecurity.org Disk /dev/sda - 214 GB / 200 GiB (RO) - VMware Virtual disk      Partition                  Start        End    Size in sectors  2 E extended             25044 191 42 26108  52 56   17084418 Pass 1 - Reading sector    8279378/17084418, 120 files found Elapsed time 0h00m41s - Estimated time for achievement 0h00m43 txt: 98 recovered sqlite: 14 recovered elf: 8 recovered   Stop

After recovering files we can Quit the Photorec to close the application. Recovered files will be stored in recup_dir directory at given location.

 Thanks for reading the article. Keep visiting and let us know your feedback.