How to Recover Deleted Files on Linux

Facebook
Twitter
LinkedIn
Reddit
Email

Accidentally deleting important files is a common issue that many users face. Fortunately, on Linux systems, it is often possible to recover deleted files using a variety of tools and techniques. This guide will walk you through the process of recovering deleted files on Linux using TestDisk, Extundelete, and PhotoRec.

Using TestDisk

TestDisk is a powerful, open-source data recovery tool designed to help users recover lost partitions and make non-booting disks bootable again.

TestDisk is primarily used for:

  • Recovering deleted or lost partitions: TestDisk can scan and recover partitions that have been accidentally deleted or damaged due to software issues, viruses, or human error.
  • Repairing partition tables: TestDisk can fix partition table errors, enabling users to access and recover their data.
  • Fixing boot sectors: TestDisk can rebuild boot sectors and repair errors that prevent a system from booting up.
  • Recovering deleted files: TestDisk can also recover deleted files from FAT, exFAT, NTFS, ext2, ext3, and ext4 file systems.
  • Copying files from deleted or damaged partitions: TestDisk allows users to copy files from partitions that are deleted or damaged to another healthy partition or storage medium.

TestDisk is a command-line utility, which might seem intimidating for users unfamiliar with the command line. However, the tool offers a text-based interface that guides users through the recovery process, making it relatively easy to use for people with varying levels of technical expertise.

Step 1: Stop Writing to Affected Partition

When a file is deleted, the space it occupied is marked as free, but the data is not immediately overwritten. To maximize the chances of successful recovery, stop using the affected partition as soon as you realize that you need to recover a deleted file.

Step 2: Open Terminal

Open the terminal by pressing Ctrl + Alt + T on your keyboard or by searching for it in the applications menu.

Step 3: Install TestDisk

On Debian/Ubuntu-based distros, run:

sudo apt install testdisk

On Fedora/RPM-based distros, run:

sudo dnf install testdisk

On Arch-based distros, run:

sudo pacman -S testdisk

Step 4: Recover Deleted Files

Run TestDisk with root privileges:

sudo testdisk

Select No Log and press Enter. Select the appropriate disk and press Enter. Select the partition table type (usually “Intel” or “EFI GPT”) and press Enter. Select Advanced and press Enter. Select the affected partition and press Enter. Select Undelete and press Enter. Browse the list of deleted files and select the ones you want to recover. Press C to copy the selected files to a safe location. Exit TestDisk once the recovery process is complete.

Using Extundelete

Extundelete is an open-source utility designed specifically for recovering deleted files from ext3 and ext4 file systems, which are commonly used in Linux distributions. It works by reading the file system’s journal to find and restore the deleted files. Extundelete is a command-line tool, and although it doesn’t have a graphical user interface, it is relatively easy to use.

Extundelete can be particularly useful for recovering files that were accidentally deleted using the rm command or deleted from the file manager without being moved to the trash first. However, it’s essential to act quickly after a file is deleted, as the space occupied by the deleted file could be overwritten by new data, making recovery impossible.

Some of the main features of Extundelete include:

  • Recovering individual files or entire directories
  • Restoring files to their original location or a specified directory
  • Recovering files based on their inode number
  • Displaying information about deleted files without actually recovering them

It’s important to note that the success of file recovery with Extundelete depends on various factors, such as the amount of time elapsed since the file was deleted and whether the file system has been extensively used after the deletion. To improve the chances of successful recovery, it’s recommended to stop using the affected partition and perform the recovery process as soon as possible.

Step 1: Stop Writing to Affected Partition

When a file is deleted, the space it occupied is marked as free, but the data is not immediately overwritten. To maximize the chances of successful recovery, stop using the affected partition as soon as you realize that you need to recover a deleted file.

Step 2: Open Terminal

Open the terminal by pressing Ctrl + Alt + T on your keyboard or by searching for it in the applications menu.

Step 3: Install Extundelete

On Debian/Ubuntu-based distros, run:

sudo apt install extundelete

On Fedora/RPM-based distros, run:

sudo dnf install extundelete

On Arch-based distros, run:

sudo pacman -S extundelete

Step 4: Recover Deleted Files

Unmount the affected partition by running:

sudo umount /dev/sdXY

Replace sdXY with the appropriate device and partition identifiers.

Run Extundelete with the following command:

sudo extundelete /dev/sdXY –restore-file /path/to/deleted/file

Replace sdXY with the appropriate device and partition identifiers and /path/to/deleted/file with the path of the deleted file. If successful, Extundelete will recover the deleted file and save it in a RECOVERED_FILES directory.

Using PhotoRec

PhotoRec is an open-source data recovery software designed to recover lost files from various types of storage media, such as hard drives, memory cards, and USB flash drives. It supports a wide range of file systems, including FAT, exFAT, NTFS, ext2, ext3, ext4, and HFS+. Despite its name, which suggests a focus on photo recovery, PhotoRec can actually recover a variety of file types, including images, documents, videos, and archives.

Developed by Christophe Grenier, the creator of TestDisk, PhotoRec is a command-line utility that features a text-based interface, making it relatively easy to use even for those who are not familiar with the command line.

The key features of PhotoRec include:

  • Recovery of lost files from various file systems and storage media
  • Support for a large number of file formats
  • Recovery of files even if the file system is severely damaged or reformatted
  • Optional expert mode for advanced settings and fine-grained control over the recovery process

PhotoRec works by searching for file signatures (i.e., patterns in the file headers) to identify and recover lost files. It does not rely on the file system’s structure, which allows it to recover files even when the file system has been damaged or reformatted. However, since it does not take the file system’s metadata into account, recovered files might have generic names and not retain their original directory structure.

Step 1: Stop Writing to Affected Partition

When a file is deleted, the space it occupied is marked as free, but the data is not immediately overwritten. To maximize the chances of successful recovery, stop using the affected partition as soon as you realize that you need to recover a deleted file.

Step 2: Open Terminal

Open the terminal by pressing Ctrl + Alt + T on your keyboard or by searching for it in the applications menu.

Step 3: Install PhotoRec

PhotoRec is bundled with TestDisk, so when you install TestDisk, you will also install PhotoRec. To install TestDisk (and consequently, PhotoRec):

On Debian/Ubuntu-based distros, run:

sudo apt install testdisk

On Fedora/RPM-based distros, run:

sudo dnf install testdisk

On Arch-based distros, run:

sudo pacman -S testdisk

Step 4: Recover Deleted Files

Run PhotoRec with root privileges:

sudo photorec

Select the appropriate disk and press Enter. Select the partition table type (usually “Intel” or “EFI GPT”) and press Enter. Select the affected partition and press Enter. Select the file system type and press Enter. Select a directory to save the recovered files and press C. PhotoRec will start scanning the partition and recovering deleted files. Once the process is complete, browse the recovery directory for your recovered files.

Conclusion

By following this guide, you should be able to recover deleted files on your Linux system using TestDisk, Extundelete, and PhotoRec. Each tool offers unique capabilities and can be used in different scenarios to maximize your chances of successful recovery. However, it is important to remember that file recovery is not always guaranteed, so it is essential to maintain regular backups of your critical data. Developing a habit of creating backups and practicing good file management can help minimize the risk of data loss and ensure that your valuable information remains safe and accessible.

Please Leave Feedback and Corrections in the Comments

More to Explore

Table of Contents

Leave a Reply

Your email address will not be published. Required fields are marked *


What are you looking for?

Type in a question or keyword below

Frequently Asked Questions

Why are your prices so high?

Our prices actually aren’t that high when you compare our laptops to models in the same class. Our Aon S1 is in the same class as the Dell XPS 13, Lenovo Thinkpad X1, and MacBook Pro. When you compare against these models, you will see our pricing is actually very reasonable, especially considering the fact that our Aon S1 has many advantages over these other models, including user-upgradeability, user-serviceability, and customizability.

Also, it’s important to note that unlike other laptop manufacturers that do final assembly in China, our laptops are built-to-order in the United States. This enables us to provide a much broader array of customization options compared to companies like Dell, Lenovo, and Apple, although at a higher cost.

Read More

Are all the parts soldered to the motherboard?

In many modern laptops, especially thin and light models (like Apple’s MacBook Air or Pro, Dell’s XPS 13, or many of Lenovo’s ThinkPad X1 Carbon models), the memory, storage, battery, and wireless module are often soldered directly onto the motherboard. This is done to save space and allow the laptop to be thinner, but it means that the RAM and SSD are not user-upgradeable.

However, as part of our commitment to the Right to Repair Movement, the memory, storage, battery, and wireless module all MALIBAL laptops are user-upgradeable or user-replaceable.

Do any of your laptops support coreboot?

Coreboot is an open-source project aimed at replacing the proprietary BIOS (Basic Input/Output System) firmware found in most computers. BIOS firmware is the first piece of software that runs when a computer is turned on. It initializes the hardware and starts the operating system.

Coreboot is designed to perform only the minimum amount of hardware initialization necessary to load and run a modern 32-bit or 64-bit operating system. This minimalist approach not only reduces the complexity and potential attack surface of the firmware, but it can also speed up the system boot time significantly.

Coreboot can be used with payloads such as a Linux kernel, SeaBIOS, or UEFI firmware to provide a complete firmware solution. It’s appreciated by users who want to have more control over their hardware, value the transparency and security that come from open-source software, or have specialized requirements.

Coreboot with EDK II is supported on our Aon line of laptops.

Can your laptops be charged or powered via USB-C?

USB-C is revolutionizing the way we charge laptops. As a universal charging standard, USB-C has a number of advantages that make it particularly suited for this task.

First and foremost, it offers high power delivery capability – up to 100 watts – which is sufficient to charge even power-hungry laptops. This eliminates the need for proprietary laptop chargers and allows for charging via common adapters, power banks, or even other laptops.

Additionally, USB-C is a reversible connector, meaning it can be inserted either way, making it more user-friendly.

It also supports data transfer and display output, allowing for a single cable to provide power, transfer data, and connect to external monitors.

All MALIBAL laptops can be powered via the Thunderbolt 4 port.

Who is MALIBAL?
MALIBAL is an innovative technology company that produces high-performance, custom linux laptops for developers and content creators; mobile workstations for engineers, scientists, video editors, 3D modelers, and animators; and mobile servers for enterprise applications. On our site, you will find information about the best linux laptops, such as our Aon S1 and Aon L1 models, our customers, new articles, latest news, guides, features, and more.
How do I get a quote?

If you need a quote for any reason, e.g., to submit to accounting for approval, before ordering, simply add the laptop(s) you want to purchase to the Cart, then click Checkout, and on the checkout page, click Convert Cart to Quote. We will email you a PDF of the quote with a link to make payment once you are ready to complete the order.

How do I cancel an order?

You may cancel an order any time up until it ships. After it ships, you will not be able to cancel it, but will instead have to use our return policy in order to return the laptop for a refund. To cancel an order, simply open a sales ticket or sales chat and give the representative your order information, and they will cancel the order for you and send you confirmation via email and text.

 

How do I make a change to my order?

You may make changes to your order up until it ships. To modify an order, simply open a sales ticket or sales chat and give the representative your order information and specify which changes you want to make.

When is my order shipping?

If all parts are in stock, the average build time for laptops is 5-7 business days. This means laptops will ship 5-7 business days after the order is placed. If a component is backordered, it will say which parts are backordered in your order confirmation email.

To see the estimated delivery date of your laptop, please check your order confirmation email for the Estimated Delivery Date. You can also see this information on your My Account > Order Details page. The estimated delivery date is the build time (plus backorder delay, if applicable) plus the shipping time.

Once your laptop ships out, we will email you the tracking information. An adult will need to be at the address to sign for the package when it arrives.

How do I track my order after it ships?

You can view your tracking status via the order details page in your account.