You Got A Question? Ask    GNOME Community!

gtk-theme2
 12760   |  Oct 25
gtk_logo2
 9642   |  Mar 17
arch
 8299   |  Mar 28
 6880   |  Jun 17

How to restore deleted files on Linux

This post was made with an older stylesheet


What can it do?

Before we begin with our example we should first clarify what TestDisk can and can’t do, so that you can determine if it can help you with your case or if you should search for something else.

TestDisk can

  • Fix partition table, recover deleted partition
  • Recover FAT32 boot sector from its backup
  • Rebuild FAT12/FAT16/FAT32 boot sector
  • Fix FAT tables
  • Rebuild NTFS boot sector
  • Recover NTFS boot sector from its backup
  • Fix MFT using MFT mirror
  • Locate ext2/ext3/ext4 Backup SuperBlock
  • Undelete files from FAT, exFAT, NTFS and ext2 filesystem
  • Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.

How to restore data

Here’s a quick example of how you can easily undelete files from an ostensibly empty hard drive. For this example I will use an old 80GB NTFS HD that contains a lot of photographs I don’t really need anymore cause I have moved them in a more modern and safer place. It should work with most HDs and other kind of files like documents, video and audio files etc, but I can’t guarantee anything of course.

hdempty

Looks as empty as Diavatis head, but is it?


It actually isn’t empty at all, as the files are there but the pointers are removed. This means that the space your files occupy is available for use when and if needed, but the files will remain there until they are replaced with new ones. This is why you may partially recover some data, or loose almost everything if you continue to use your driver normally. What you should do instead is try to recover as fast as possible while using your drive as little as possible.

Unfortunately for SSD owners this doesn’t apply, as solid state drivers remove immediately the data of any deleted files :(

Here is where TestDisk recovery tool comes to save the day… Install testdisk package and then launch by typing “testdisk” on a terminal. For data restore you will need to run as root, so type “sudo testdisk“. Proceed as shown below, by choosing your disk and filesystem.

testdiskmain

testdiskselectdisk

testdiskfstype

testdiskundelete

For undeleting you choose the Advanced options menu. Navigation of all menus is done through arrow keys and Enter

undelete

You may then use the arrow keys again to select Undelete option and press the Enter button


This will make TestDisk search the selected hard drive and display all found inodes. Each inode on the following screen represents a file system object (photographs in my case) but not the filenames. You can determine or just guess what is what by the modification date and file size shown on the right.

lastsummer

You can now proceed with selecting the files to restore by pressing the : button, or just select everything in case you are not sure what all this is by pressing the a button. In this case, make sure you have enough disk space for the recovery. Page Up/Down buttons also work as expected…

When the selection part is done you press the C button that will bring you to the “destination” screen.

destination

Select the folder where you want the restored files to go and press the C button again


TestDisk will then begin copying the selecting files to the desired destination. The process is relatively fast, but you may have to wait some time depending on the size, file number and disk speed. After all is done, and if everything went well you should see some inode files inside the destination folder.

pictures

These files are basically photographs, but I can’t open them just like that because user root dropped them in here. I should change the file permissions or open them through a root-launched application. In my case it is gimp so giving “sudo gimp” on a terminal will launch gimp as superuser and then choose File/Open/destinationfolder/inode_8641

lee-bee

And there we are! Lee-Bee enjoying the beach…


Other ways…

This isn’t the only way to restore files of course, and to be honest I am not sure about whether this is the fastest and simplest, as I am not a data restoring expert. It would be great if you people leave comments linking to other data restoring articles, or write some quick guides and send them to us to publish and share the knowledge with everyone!

Linux is of course very rich in almost every sector and data restoring is not an exception, so here is a list of more tools for you to give a try in case TestDisk didn’t do the trick in your case…

Good luck and have fun restoring lost files and memories :)


 
  We can't watch comments unless G+ provides an API or if you send a notification, e.g +World Of Gnome
     Sometimes is better to place your questions on GNOME Community
  • Thien Tranduy

    thank, very good

  • http://ekd123.org/ Mike Manilone

    Why not make a GUI for it? That should be easier for normal users like me. :-)

    • C

      Nah, GUIs are a waste of time for systems tools. Nubs have no business doing such things.

  • Rafael Wingnux

    TestDisk has already saved my life! =)

  • http://www.facebook.com/eddie.oconnor1 Eddie O’Connor

    This is SO helpful! I’m just getting my feet wet with the “administration side” of Linux and to know there’s a way to restore or recover accidentally deleted files is WONDERFUL! I also agree with Mike Manilone…..there SHOULD be a GUI for it! It woulod make life for the “newbies” out there SO much easier…but it’s STILL excellent knowledge to have! Thanks again!!!

  • Pingback: Links 13/3/2013: Akamai Gives GNU/Linux Numbers; Sabayon Linux 11 Reviewed | Techrights

  • Pingback: How to restore deleted files on Linux | Linux A.I

  • Paulo

    For SSDs you can try photorec that searches for the footprint of images in the blocks of the disk.

  • Pingback: How to restore deleted files on Linux

  • Pingback: How to restore deleted files on Linux | Thelinuxgeek

  • Dany Dylan

    Good article. For ext3 and ext4 file systems check out also http://extundelete.sourceforge.net/

  • Craig

    How can you do an article about testdisk without mentioning photorec?

  • Punit

    Please help me on this….
    I am not getting undeleted option.
    Its SUSE Enterprises 12.0
    I have did rm -rf /home/
    Want to recover this…

    This testdisk i found use full but this undeleted option is not comming…
    Sombody please help…
    Uts little urgent n m in big problem.

    • billtoulas

      Are you using a solid state drive? What kind of partition type did you choose?