How to Recover Deleted Files in Linux

Oops! You accidentally deleted files that you were supposed to submit in 2 hours! Trust me, even the smartest of geeks have been in such situations. And yes, it’s not the lack of technological savoir-faire that puts people in such tough spots; it’s just the general clumsiness and nervousness in certain situation that makes us make such blunders.

On Windows and Mac, you can simply Google for it and you’ll find a plethora of sharewares and freewares that will help you recover files. However, on Linux, there’s a dearth of such applications thus making it harder for new users to get back the files they deleted. Don’t worry though, as we at TechSource have listed a simple method of getting back the stuff you lost without going through hoops. So, without much ado, here’s how to recover deleted files on Linux:

PhotoRec is a free and open-source application that lets you recover lost files from hard disk, digital camera and CD-ROM. It can help you get back lost videos, documents, and photos from your digital card memory. The application works equally well even when the file system is severely damaged or even formatted, thus making it one of the best hard drive data recovery tools for Linux.

To get started, simply install PhotoRec by typing in or pasting the following command in your terminal (Ctrl + Alt + T):

sudo apt-get install testdisk

The program is around 650 KB, so it wouldn't take much time to install even on slow connections. Once installed, type in ‘photorec’ without any quotes. The program has an ncurses UI, so there won’t be any need to type in commands, simply navigate the interface using the arrow keys and punch in the return key to select a menu.

Firstly, select the hard disk from which you want to recover the files from. If you can’t recognize your hard disk easily, just look at your laptop or desktop’s manual and see the amount of hard disk space your computer has. Now match that space with the options mentioned in the list and select the correct one. Hit proceed and the app will then ask you to choose the file system. If you have fewer partitions, you won’t have much trouble identifying the right one; however, in case you have many disk partitions like me, then you’d have to guess the right one by its size. Simply look at the column that denotes the size of the partition in sectors. Then, match it approximately with the disk in which your lost data was stored.

Once that is done, choose an output folder wherein your recovered files will be stored. Now, sit back and relax as your precious file return to where you want them to be.

Note: It’s always better to backup your data instead of scrounging around for recovery solutions. We've already covered some of the best backup solutions for Linux. These are all open-source applications and most of them don’t require the use of the dreaded command-line.

Linux-based Hard Drive Data Recovery Tools

inux-based Hard Drive Data Recovery Tools: If your hard drive is unbootable due to corrupt partition tables, computer viruses, system errors, and other non-mechanical issues, you may consider using a hard drive data recovery tool to save your precious files or data from being permanently wiped out. Thankfully, there are tons of available Linux-based rescue tools that can get the job done quickly and easily. I have here a list of some of the most well-known Linux-based hard drive data recovery tools that you can use freely:

SystemRescueCd

SystemRescueCd is a Gentoo-based Linux distribution that is loaded with essential features for rescuing damaged computer systems. It is able to run from a Live CD or from a USB flash drive, and comes with an easy-to-use graphical desktop environment. Here are some of SystemRescueCd's features and software packages that can be used for hard drive data recovery:

* fdisk for editing disk partition table
* PartImage disk imaging software
* TestDisk for recovering lost partition
* PhotoRec for recovering lost data
* GNU Parted and GParted for partitioning disks and resizing partitions
* File system tools: file system create, delete, resize, move
* Ability to create boot disk for operating systems

You may also want to check out my review of SystemRescueCd for more information.

Ubuntu Rescue Remix

Ubuntu Rescue Remix is a live system that can run from CD or USB flash device and has a full command-line environment. It offers up-to-date versions of some of the most capable open-source hard drive data recovery software, which includes GNU ddrescue, Photorec, The Sleuth Kit and Gnu-fdisk. Some of the packages included on the latest version of Ubuntu Rescue Remix are aoetools, array-info, ext3-grep, gptsync, kpartx, and scrounge-ntfs.

F-Secure Rescue CD

Based on Knoppix, F-Secure Rescue CD is specially designed to rescue systems affected by viruses, trojans, worms, and other malware. It can securely boot-up and check the files from the compromised hard drive or view the programs installed. It is also capable of doing more advanced repair and hard drive data recovery operations.

Trinity Rescue Kit (TKR)

Trinity Rescue Kit or TKR is a bootable command-line Linux distro that is mainly based on Mandriva Linux. It is primarily aimed for recovery and repair operations on Windows machine, but it can also be used on Linux. It is bootable from a USB storage device, CD, or through a network using PXE. Trinity Rescue Kit eliminates the standard Linux manual command so that it can save disk space. Here are some of its hard drive data recoveryfeatures:

* can easily reset windows passwords
* full NTFS write support
* clone NTFS filesystems over the network
* easy script to find all local filesystems
* recovery of files with utilities and procedures
* recovery of lost partitions
* evacuation of dying disks
* powerful multicast disk cloning utility for any filesystem



Ddrescue

Ddrescue is a simple hard drive data recovery software that has the ability to copy data from one file or block device to another, thus rescuing data in case of read errors. The basic operation of ddrescue is fully automated but you can stop the rescue at any time and restart it later right where you left off. Because Ddrescue is not a Live CD or a Linux distro, you will have to install it first on your Linux system, and then mount the affected hard drive to start rescuing data.

How to recover lost files ( Linux, Windows, MacOs, Dos, Sun Solaris etc...)

How to recover lost files ( Linux, Windows, MacOs, Dos, Sun Solaris etc...)

Every single person who is using PC(Personal Computer) are doing some work like monitoring, programming or stores etc. that saves it in hard disk. The hard disk can store any type of data like images, text, multimedia etc. Some times user may delete data accidentally but they need it later on. In these kind of situations, recovery softwares come into play.

The loss data occurs not only by deleting but there are several reasons, and one of them is Hard driver corrupt. In Windows Operating System, we can recover the deleted data by using some useful software tools but this procedure is not possible in Linux.

Add caption

Computer’s data is not completely deleted from hard drive. It remains somewhere in some form for some time unless the user stores more data by filling up the space. The user can easily recover data by using some powerful tools. In Linux, if the user is going to use any tool for recovery like PhotoRec, TestDisk, these requires a small idea for the user about how the file deletion occured? or when the file is deleted? etc.,

TestDisk can recover lost partitions of any file system. PhotoRec is a file data recovery software designed to recover lot of files including video, documents and archives from Hard Disks and lost pictures from digital camera memory(thus, its ‘Photo Recovery’). PhotoRec ignores the filesystem and goes after the underlying data, so it still works even if users media filesystem has been severely damaged or re-formatted.

Both PhotoRec and TestDisk were DOS, Windows(9x,NT,2000,XP,2003), Linux, FreeBSD, NetBSD, OpenBSD, Sun Solaris and MAC OS X compatible. It can be compiled and run on most Linux systems.

PhotoRec Step By Step

This Recovery example guides you through PhotoRec step by step to recover deleted files or lost data from a reformatted partition or corrupted file system. For lost/deleted partitions or deleted files from a FAT or NTFS file system, try TestDisk first - it's usually faster and TestDisk can retrieved the original file names

Run PhotoRec executable

If PhotoRec is not yet installed, it can be downloaded from TestDisk Download. Extract the files from the archive including the sub-directories.

To recover files from hard disk, USB key, Smart Card, CD-ROM, DVD, etc., you need enough rights to access the physical device.

•  Under DOS, run photorec.exe
•  Under Windows, start PhotoRec (ie testdisk-6.9/win/photorec_win.exe) from an account in the Administrator group. Under Vista, right click photorec_win.exe and then click Run as administrator to launch PhotoRec.
•  Under Unix/Linux/BSD, you need to be root to run PhotoRec (ie. sudo testdisk-6.9/linux/photorec_static)
•  Under MacOSX, start PhotoRec (ie testdisk-6.9/darwin/photorec). If you are not root, PhotoRec will restart itself using sudo after a confirmation on your part. Sudo will ask for a password - enter your Mac OS X user password.
•  Under OS/2, PhotoRec doesn't handle physical device, only disk images. Sorry.

To recover files from a media image, run

• photorec image.dd to carve a raw disk image
• photorec image.E01 to recover files from an Encase EWF image
• photorec 'image.???' if the Encase image is split into several files.
• photorec '/cygdrive/d/evidence/image.???' if the Encase image is split into several files in the directory d:\evidence

  Most devices should be autodetected including Linux software RAID (ie. /dev/md0) and file system encrypted with cryptsetup, dm-crypt, LUKS or TrueCrypt (ie./dev/mapper/truecrypt0). To recover files from other devices, run photorec device.

Forensics users can use the parameter /log to create a log file named photorec.log; it records the location of the files recovered by PhotoRec.

Disk selection

Available media are listed. Use up/down arrow keys to select the disk that holds the lost files. Press Enter to proceed.

 If available, use raw device /dev/rdisk* instead of /dev/disk* for faster data transfer.

Partition table type selection

Select the partition table type - usually the default value is the correct one as PhotoRec auto-detects the partition table type.

Source partition selection

Choose

• Search after selecting the partition that holds the lost files to start the recovery,
• Options to modify the options,
• File Opt to modify the list of file types recovered by PhotoRec.

PhotoRec options

• Paranoid By default, recovered files are verified and invalid files rejected.

Enable bruteforce if you want to recover more fragmented JPEG files, note it's a very CPU intensive operation.

• Allow partial last cylinder modifies how the disk geometry is determined - only non-partitioned media should be affected.
• The expert mode option allows the user to force the file system block size and the offset.
• Enable Keep corrupted files to keep files even if they are invalid in the hope that data may still be salvaged from an invalid file using other tools.
• Enable Low memory if your system doesn't have enough memory and crashes during recovery. It may be needed for large file systems that are heavily fragmented. Don't use this option unless absolutely necessary.

Selection of files to recover

In FileOpts, enable or disable the recovery of certain file types, e.g.

[X] riff RIFF audio/video: wav, cdr, avi
...
[X] tif  Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
...
[X] zip  zip archive including OpenOffice and MSOffice 2007

The whole list of file formats recovered by PhotoRec contains more than 320 file families representing more than 200 file extensions.

File system type

Once a partition has been selected and validated with Search, PhotoRec needs to know how the data blocks are allocated. Unless it's ext2/ext3 filesystem, choose Other.

Carve the partition or unallocated space only

PhotoRec can search files from

• from the whole partition (useful if the filesystem is corrupted) or
• from the unallocated space only (available for ext2/ext3/ext4, FAT12/FAT16/FAT32 and NTFS). With this option only deleted files are recovered.

Select where recovered files should be written

Choose the directory where the recovered files should be written.

•    To get the drive list (C:, D:, E:, etc.), use the arrow keys to select .., press the Enter key - repeat until you can select the drive of your choice. Validate with Yes when you get the expected destination.
•  File system from external disk may be available in a /media or /mnt sub-directory.
•  Partitions from external disk are usually mounted in /Volumes.

Recovery in progress

Number of recovered files is updated in real time.

• During pass 0, PhotoRec searches the first 10 files to determine the blocksize.
• During pass 1 and later, files are recovered including some fragmented files.

Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It's possible to access the files even if the recovery is not finished.

Recovery is completed

When the recovery is complete, a summary is displayed. Note that if you interrupt the recovery, the next time PhotoRec is restarted you will be asked to resume the recovery.

Linux Data Recovery Using \'myrescue\' Utility

In Linux operating system, myrescue is an utility to retrieve still-readable information from damaged hard drive. This Linux Data Recovery tool is similar to the dd_rescue, however it attempts to quickly get out of corrupted area to handle undamaged part first. After extracting data from the undamaged area, the utility then returns to the damaged area and tries to fix it. 

The myrescue utility attempts to copy your hard drive block-wise to the file and creates a block bitmap (table) remarking whether the block is successfully copied, not handled yet or it has errors. The block bitmap or table can be employed in the successive runs for concentrating on unresolved blocks.  

This Data Recovery Linux utility effectively handles the read errors, through its special skip way. General the hard drive surface blemishes cover more than simply one data block and uninterrupted reading data from the defected areas may damage the hard drive surface, the hard drive mechanisms, and read/write heads. 

When it occurs, the possibilities of retrieving the remaining and undamaged data decreased dramatically. Therefore in the skip mode of myrescue, it attempts to escape the damaged area quickly by exponentially incrementing the step size. It marks the skipped blocks as un-handled in block bitmap table and they may be retrieved at later stage. 

Ultimately, the utility has an advanced option to multiply attempt for reading data from a data block, before believing it is damaged. 

However, you should bear in mind that the this utility is not a replacement for third-party data recovery utilities. When you have a second option, do not even try to use myrescue, as the tool may cause more damage to your hard drive. 

The myrescue utility is available only for the situation that you\'re completely desperate and cannot afford any professional Linux Recovery utility. If your data is highly significant for your business, it is worth to go for professional recovery applications. 

The Linux Data Recovery software are able to handle all types of data loss situations, ranging from simple deletion to the most severe file system corruption. The applications carry out in-depth scan of entire Linux hard drive and extract all lost, missing, and inaccessible data from it. The come equipped with simple and rich graphical user interface, to allow you to carry out Do It Yourself recovery. 

Stellar Phoenix Linux Data Recovery is the most familiar and powerful program that ensures absolute recovery of all your lost data. The software recovers data from Ext4, Ext3, Ext2, FAT12, FAT16, and FAT 32 file system volumes. It is compatible with all major distributions of Linux operating systems including SUSE, Debian, Red Hat, and Fedora.