How to Recover Deleted Files on Linux
How to Recover Deleted Files on Linux
sudo mount -o ro /dev/sdb1 /media/-only It's also a good practice to clone the partition to another drive. It will ensure you don't lose the source partition while restoring data. You can use . The command below clones the contents of /dev/sdb1 to the sda1 partition of /dev/sda, a different drive. dd =sdb1 =sda1 bs=M
sudo apt testdisk
sudo yum epel-
sudo yum testdisk
sudo pacman -S testdisk Once installed, start TestDisk by opening a terminal and typing the testdisk command. sudo testdisk You'll find yourself at the TestDisk interactive prompt. Use the arrow keys on your keyboard to navigate and press Enter to select options. The first available option is to create a log file. Go ahead and create one. The following screen will display a list of storage media connected to your system. Choose the device that contains the deleted files. We're using the /dev/sdb media for this guide. Select yours accordingly, and press Proceed. The next screen will prompt you to select the partition type for your disk. Choose the correct one for your drive. Note that TestDisk will try to detect the right type itself. So, if you're not sure, go with the partition type detected by TestDisk. You'll see several options available on the following screen. The Analyse option is useful for recovering lost partitions. However, we'll use the Advanced option to recover deleted files. Next, you'll see a list of all the partitions present on your selected device. Select the partition that holds your deleted data and choose Undelete from the bottom menu. TestDisk will scan the MFT entries for deleted files on this partition and list them here. We're looking for the file picture.jpg shown on this screen. You can select/deselect specific files using : and all files using a. After selecting which files to recover, press C to copy them. You'll be prompted to choose the recovery destination. Navigate there and press C to save the file.
sudo apt foremost
sudo dnf foremost
sudo pacman -S foremost Once installed, using the software is relatively straightforward. You can list all possible options for foremost using the below command: foremost -h We can recover the deleted file picture.jpg using the following foremost command: foremost -v -t jpg -i /dev/sdb1 -o ~ This command will search all lost JPG images in /dev/sdb1 and restore them to ~/recovery. The -v flag enables verbose logging, -i specifies the source partition, and -o specifies the output directory. The -t option allows users to specify which files to search. Foremost supports various file types and can locate images, videos, text, and executables. You can search for multiple extensions using a comma-separated list.
sudo apt extundelete
sudo yum extundelete
sudo yay -S extundelete Once installed, you can proceed to recover deleted files from your Linux system using extundelete. Use the below command to restore a specific file quickly. Note that the file path is relative to the root of the partition. sudo extundelete The next command retrieves all files from the partition /dev/sdb1. Change the partition name to match your source. sudo extundelete If you want to save the restored files to a specific directory, specify it using the -o option. sudo extundelete -o ~dev/sdb1 By default, extundelete saves the recovered files inside the RECOVERED_FILES/ sub-directory.
MUO
How to Recover Deleted Files on Linux
Accidentally removed a file on your Linux desktop? Don't fret. Here's how you can easily recover deleted files on Linux. Losing data is something all PC users have to face at some point. Be it a hard-disk crash or an accidental deletion, we all have been in situations where we wished we could get the deleted data back. Luckily, recovering deleted files is simpler on Linux than on other operating systems. You can easily recover deleted files using tools like TestDisk, PhotoRec, and Foremost.Things to Know Before You Begin
Linux systems offer Trash/Recycle Bin facilities for softly deleted data. So if you've deleted files using the Delete button on your keyboard, you can instantly get those back by visiting the Trash and restoring them. However, if you've deleted the files permanently using Shift + Del, you'll need to recover them using one of the available for Linux. But since different programs use different methods for recovering lost data, it may take multiple tries to get all deleted files on Linux. Thankfully, even in the case of permanent deletion, the data isn't lost right away. They are hidden from the filesystem and will only get erased when you overwrite them. So the first step for recovering lost data from a hard disk partition is to make the partition read-only. It ensures that you don't accidentally overwrite the deleted data. For example, if the deleted files are on the partition /dev/sdb1, you first need to unmount it and then remount it as read-only. You can do so using the below commands. Make sure to adjust the partition name according to your system. sudo umount /dev/sdb1sudo mount -o ro /dev/sdb1 /media/-only It's also a good practice to clone the partition to another drive. It will ensure you don't lose the source partition while restoring data. You can use . The command below clones the contents of /dev/sdb1 to the sda1 partition of /dev/sda, a different drive. dd =sdb1 =sda1 bs=M
Recover Deleted Files on Linux Using TestDisk
TestDisk is an open-source data recovery program that can effectively recover permanently deleted files or partitions. It's packed with many useful features and provides an easy-to-use interface. You can using the following commands:sudo apt testdisk
sudo yum epel-
sudo yum testdisk
sudo pacman -S testdisk Once installed, start TestDisk by opening a terminal and typing the testdisk command. sudo testdisk You'll find yourself at the TestDisk interactive prompt. Use the arrow keys on your keyboard to navigate and press Enter to select options. The first available option is to create a log file. Go ahead and create one. The following screen will display a list of storage media connected to your system. Choose the device that contains the deleted files. We're using the /dev/sdb media for this guide. Select yours accordingly, and press Proceed. The next screen will prompt you to select the partition type for your disk. Choose the correct one for your drive. Note that TestDisk will try to detect the right type itself. So, if you're not sure, go with the partition type detected by TestDisk. You'll see several options available on the following screen. The Analyse option is useful for recovering lost partitions. However, we'll use the Advanced option to recover deleted files. Next, you'll see a list of all the partitions present on your selected device. Select the partition that holds your deleted data and choose Undelete from the bottom menu. TestDisk will scan the MFT entries for deleted files on this partition and list them here. We're looking for the file picture.jpg shown on this screen. You can select/deselect specific files using : and all files using a. After selecting which files to recover, press C to copy them. You'll be prompted to choose the recovery destination. Navigate there and press C to save the file.
Recover Deleted Files on Linux Using PhotoRec
PhotoRec is another powerful data recovery program created by the developers of TestDisk. It was developed for on Linux but evolved into a full-fledged program of its own. You can use PhotoRec to recover all sorts of deleted files. The difference between TestDisk and PhotoRec is that the latter can retrieve files even from disks that have been corrupted beyond repair. It uses file signatures to detect deleted files which makes it immensely powerful. However, files retrieved via PhotoRec don't retain their original filename. You can install PhotoRec on using the same commands used for installing TestDisk. So, if you have already installed TestDisk, you don't need to install PhotoRec again. If you didn't install TestDisk earlier, check out the above section and install the testdisk package. sudo photorec This command will start PhotoRec and take you to the start menu. The layout is similar to TestDisk, and so is the navigation. You'll be prompted to choose the disk media. Select the correct one and press Proceed. You will then need to choose the source partition. Select the appropriate partition and choose File Opt from the bottom menu. Here, you can specify the file type of your deleted files. PhotoRec selects all filetypes by default. You can disable all using s and select a specific type using x. We're selecting jpg for recovering our image file. Now go back using q and select the Search option to start file recovery on Linux. You'll then need to select the filesystem type. Choose Other if the source partition is not ext3/ext4. At this step, you must specify whether to search for the selected filetypes in the entire partition or just in the free space. We're selecting the Free Space option to search faster. The next step requires users to choose the destination directory. Make sure not to save files on the same partition you're scanning. Navigate to the desired location using the arrow keys and press C to save. PhotoRec will now scan the free sectors and save the recovered files to the selected destination. It'll save recovered files under a directory called recup_dir.Recover Deleted Files Using Foremost on Linux
Foremost is a free data recovery tool for Linux. It comes with a simple CLI interface. Although the software isn't as interactive as TestDisk or PhotoRec, it still proves helpful in certain scenarios. You can install Foremost on Linux using the following commands:sudo apt foremost
sudo dnf foremost
sudo pacman -S foremost Once installed, using the software is relatively straightforward. You can list all possible options for foremost using the below command: foremost -h We can recover the deleted file picture.jpg using the following foremost command: foremost -v -t jpg -i /dev/sdb1 -o ~ This command will search all lost JPG images in /dev/sdb1 and restore them to ~/recovery. The -v flag enables verbose logging, -i specifies the source partition, and -o specifies the output directory. The -t option allows users to specify which files to search. Foremost supports various file types and can locate images, videos, text, and executables. You can search for multiple extensions using a comma-separated list.
Recover Deleted Files on Linux Using extundelete
extundelete is a data recovery program that can recover deleted files from ext3/ext4 filesystems. These are the filesystems used by popular . You can install extundelete using one of the following commands:sudo apt extundelete
sudo yum extundelete
sudo yay -S extundelete Once installed, you can proceed to recover deleted files from your Linux system using extundelete. Use the below command to restore a specific file quickly. Note that the file path is relative to the root of the partition. sudo extundelete The next command retrieves all files from the partition /dev/sdb1. Change the partition name to match your source. sudo extundelete If you want to save the restored files to a specific directory, specify it using the -o option. sudo extundelete -o ~dev/sdb1 By default, extundelete saves the recovered files inside the RECOVERED_FILES/ sub-directory.