How to restore deleted files on Linux

Mishaps happen and things can go wrong for everyone when it comes to data loss, especially if you are the “never backup anything” kind of guy.

Hopefully, Linux offers more than enough tools that allow you to find and restore a part or all of your lost data intact. Here is a quick how-to for the very simple to use TestDisk tool!

What can it do?

Before we begin with our example we should first clarify what TestDisk can and can’t do, so that you can determine if it can help you with your case or if you should search for something else.

TestDisk can

• Fix partition table, recover deleted partition
• Recover FAT32 boot sector from its backup
• Rebuild FAT12/FAT16/FAT32 boot sector
• Fix FAT tables
• Rebuild NTFS boot sector
• Recover NTFS boot sector from its backup
• Fix MFT using MFT mirror
• Locate ext2/ext3/ext4 Backup SuperBlock
• Undelete files from FAT, exFAT, NTFS and ext2 filesystem
• Copy files from deleted FAT, exFAT, NTFS and ext2/ext3/ext4 partitions.

How to restore data

Here’s a quick example of how you can easily undelete files from an ostensibly empty hard drive. For this example I will use an old 80GB NTFS HD that contains a lot of photographs I don’t really need anymore cause I have moved them in a more modern and safer place. It should work with most HDs and other kind of files like documents, video and audio files etc, but I can’t guarantee anything of course.

Looks as empty as Diavatis head, but is it?

It actually isn’t empty at all, as the files are there but the pointers are removed. This means that the space your files occupy is available for use when and if needed, but the files will remain there until they are replaced with new ones. This is why you may partially recover some data, or loose almost everything if you continue to use your driver normally. What you should do instead is try to recover as fast as possible while using your drive as little as possible.

Unfortunately for SSD owners this doesn’t apply, as solid state drivers remove immediately the data of any deleted files :(

Here is where TestDisk recovery tool comes to save the day… Install testdisk package and then launch by typing “testdisk” on a terminal. For data restore you will need to run as root, so type “sudo testdisk“. Proceed as shown below, by choosing your disk and filesystem.

For undeleting you choose the Advanced options menu. Navigation of all menus is done through arrow keys and Enter

You may then use the arrow keys again to select Undelete option and press the Enter button

This will make TestDisk search the selected hard drive and display all found inodes. Each inode on the following screen represents a file system object (photographs in my case) but not the filenames. You can determine or just guess what is what by the modification date and file size shown on the right.

You can now proceed with selecting the files to restore by pressing the : button, or just select everything in case you are not sure what all this is by pressing the a button. In this case, make sure you have enough disk space for the recovery. Page Up/Down buttons also work as expected…

When the selection part is done you press the C button that will bring you to the “destination” screen.

Select the folder where you want the restored files to go and press the C button again

TestDisk will then begin copying the selecting files to the desired destination. The process is relatively fast, but you may have to wait some time depending on the size, file number and disk speed. After all is done, and if everything went well you should see some inode files inside the destination folder.

These files are basically photographs, but I can’t open them just like that because user root dropped them in here. I should change the file permissions or open them through a root-launched application. In my case it is gimp so giving “sudo gimp” on a terminal will launch gimp as superuser and then choose File/Open/destinationfolder/inode_8641

And there we are! Lee-Bee enjoying the beach…

Other ways…

This isn’t the only way to restore files of course, and to be honest I am not sure about whether this is the fastest and simplest, as I am not a data restoring expert. It would be great if you people leave comments linking to other data restoring articles, or write some quick guides and send them to us to publish and share the knowledge with everyone!

Linux is of course very rich in almost every sector and data restoring is not an exception, so here is a list of more tools for you to give a try in case TestDisk didn’t do the trick in your case…

• System Rescue CD
• Ubuntu Rescue Remix
• Scalpel
• Ddrescue
• Safecopy

Good luck and have fun restoring lost files and memories :)