Losing data is something all PC users have to face at some point. Be it a hard-disk crash or an accidental deletion, we all have been in situations where we wished we could get the deleted data back.
Luckily, recovering deleted files is simpler on Linux than on other operating systems. You can easily recover deleted files using tools like TestDisk, PhotoRec, and Foremost.
Things to Know Before You Begin
Linux systems offer Trash/Recycle Bin facilities for softly deleted data. So if you've deleted files using the Delete button on your keyboard, you can instantly get those back by visiting the Trash and restoring them.
However, if you've deleted the files permanently using Shift + Del, you'll need to recover them using one of the data recovery software available for Linux. But since different programs use different methods for recovering lost data, it may take multiple tries to get all deleted files on Linux.
Thankfully, even in the case of permanent deletion, the data isn't lost right away. They are hidden from the filesystem and will only get erased when you overwrite them. So the first step for recovering lost data from a hard disk partition is to make the partition read-only. It ensures that you don't accidentally overwrite the deleted data.
For example, if the deleted files are on the partition /dev/sdb1, you first need to unmount it and then remount it as read-only. You can do so using the below commands. Make sure to adjust the partition name according to your system.
sudo umount /dev/sdb1
sudo mount -o ro /dev/sdb1 /media/read-only
It's also a good practice to clone the partition to another drive. It will ensure you don't lose the source partition while restoring data. You can use dd to clone Linux partitions. The command below clones the contents of /dev/sdb1 to the sda1 partition of /dev/sda, a different drive.
dd if=/dev/sdb1 of=/dev/sda1 bs=1M
Recover Deleted Files on Linux Using TestDisk
TestDisk is an open-source data recovery program that can effectively recover permanently deleted files or partitions. It's packed with many useful features and provides an easy-to-use interface. You can install TestDisk on Linux using the following commands:
# Ubuntu and Debian
sudo apt install testdisk
# RHEL and CentOS
sudo yum install epel-release
sudo yum install testdisk
# Arch Linux
sudo pacman -S testdisk
Once installed, start TestDisk by opening a terminal and typing the testdisk command.
sudo testdisk
You'll find yourself at the TestDisk interactive prompt. Use the arrow keys on your keyboard to navigate and press Enter to select options. The first available option is to create a log file. Go ahead and create one.
The following screen will display a list of storage media connected to your system. Choose the device that contains the deleted files. We're using the /dev/sdb media for this guide. Select yours accordingly, and press Proceed.
The next screen will prompt you to select the partition type for your disk. Choose the correct one for your drive. Note that TestDisk will try to detect the right type itself. So, if you're not sure, go with the partition type detected by TestDisk.
You'll see several options available on the following screen. The Analyse option is useful for recovering lost partitions. However, we'll use the Advanced option to recover deleted files.
Next, you'll see a list of all the partitions present on your selected device. Select the partition that holds your deleted data and choose Undelete from the bottom menu.
TestDisk will scan the MFT entries for deleted files on this partition and list them here. We're looking for the file picture.jpg shown on this screen.
You can select/deselect specific files using : and all files using a. After selecting which files to recover, press C to copy them.
You'll be prompted to choose the recovery destination. Navigate there and press C to save the file.
Recover Deleted Files on Linux Using PhotoRec
PhotoRec is another powerful data recovery program created by the developers of TestDisk. It was developed for recovering deleted photos on Linux but evolved into a full-fledged program of its own. You can use PhotoRec to recover all sorts of deleted files.
The difference between TestDisk and PhotoRec is that the latter can retrieve files even from disks that have been corrupted beyond repair. It uses file signatures to detect deleted files which makes it immensely powerful. However, files retrieved via PhotoRec don't retain their original filename.
You can install PhotoRec on different Linux distros using the same commands used for installing TestDisk. So, if you have already installed TestDisk, you don't need to install PhotoRec again. If you didn't install TestDisk earlier, check out the above section and install the testdisk package.
sudo photorec
This command will start PhotoRec and take you to the start menu. The layout is similar to TestDisk, and so is the navigation. You'll be prompted to choose the disk media. Select the correct one and press Proceed.
You will then need to choose the source partition. Select the appropriate partition and choose File Opt from the bottom menu.
Here, you can specify the file type of your deleted files. PhotoRec selects all filetypes by default. You can disable all using s and select a specific type using x. We're selecting jpg for recovering our image file.
Now go back using q and select the Search option to start file recovery on Linux.
You'll then need to select the filesystem type. Choose Other if the source partition is not ext3/ext4.
At this step, you must specify whether to search for the selected filetypes in the entire partition or just in the free space. We're selecting the Free Space option to search faster.
The next step requires users to choose the destination directory. Make sure not to save files on the same partition you're scanning. Navigate to the desired location using the arrow keys and press C to save.
PhotoRec will now scan the free sectors and save the recovered files to the selected destination. It'll save recovered files under a directory called recup_dir.
Recover Deleted Files Using Foremost on Linux
Foremost is a free data recovery tool for Linux. It comes with a simple CLI interface. Although the software isn't as interactive as TestDisk or PhotoRec, it still proves helpful in certain scenarios. You can install Foremost on Linux using the following commands:
# Ubuntu and Debian
sudo apt install foremost
# Fedora
sudo dnf install foremost
# Arch Linux
sudo pacman -S foremost
Once installed, using the software is relatively straightforward. You can list all possible options for foremost using the below command:
foremost -h
We can recover the deleted file picture.jpg using the following foremost command:
foremost -v -t jpg -i /dev/sdb1 -o ~/recovery/
This command will search all lost JPG images in /dev/sdb1 and restore them to ~/recovery. The -v flag enables verbose logging, -i specifies the source partition, and -o specifies the output directory.
The -t option allows users to specify which files to search. Foremost supports various file types and can locate images, videos, text, and executables. You can search for multiple extensions using a comma-separated list.
Recover Deleted Files on Linux Using extundelete
extundelete is a data recovery program that can recover deleted files from ext3/ext4 filesystems. These are the filesystems used by popular Linux distros like Ubuntu. You can install extundelete using one of the following commands:
# Ubuntu and Debian
sudo apt install extundelete
# RHEL and CentOS
sudo yum install extundelete
# Arch Linux
sudo yay -S extundelete
Once installed, you can proceed to recover deleted files from your Linux system using extundelete. Use the below command to restore a specific file quickly. Note that the file path is relative to the root of the partition.
sudo extundelete --restore-file picture.jpg /dev/sdb1
The next command retrieves all files from the partition /dev/sdb1. Change the partition name to match your source.
sudo extundelete --restore-all /dev/sdb1
If you want to save the restored files to a specific directory, specify it using the -o option.
sudo extundelete -o ~/recovery --restore-all /dev/sdb1
By default, extundelete saves the recovered files inside the RECOVERED_FILES/ sub-directory.
Recover Deleted Files on Linux Using R-Linux
R-Linux is a GUI data recovery tool for Linux that's free of charge but not open-source. It can scan ext2/ext3/ext4 filesystems for deleted files and recover them. You can download the R-Linux binary from the R-Tools Technology website for your specific distro.
Download: R-Linux
Once downloaded, install it using your package manager. After installation, open the software by going through your applications menu. Enter sudo password when prompted.
Now, choose the source partition that contains the deleted files and scan it using the GUI. You can choose from different scan methods based on your requirements.
Wait until the scan finishes to see a list of deleted files. Choose the ones you need and restore them from the top menu.
Get Deleted Files Back on Linux
Thanks to so many high-quality data recovery programs, recovering deleted files is quite easy on Linux. You can select any of the above tools based on the deleted file's type and your system's partition configuration. However, we recommend TestDisk and PhotoRec because they provide a clean and simple interactive prompt.
Since recovering data can be a nightmare for many, you should always store backups on external devices. It'll make retrieving deleted data just a few clicks away.