7 ways to recover deleted files on Linux

COMBOFRE June 23, 2023

0 6 7 minutes read

File restoration instruments are among the many most necessary applications in a Linux administrator’s toolkit. It offers the power to get better deleted recordsdata on Linux, even in instances the place the disk is bodily broken or has been erased.

This information outlines seven easy file restoration instruments that you would be able to set up proper now on Linux. We additionally present you how one can carry out deleted file restoration on Linux.

Get well deleted recordsdata on Linux utilizing your file supervisor

While you delete a file, solely the affiliation between it and its underlying information is deleted. The bodily file itself stays intact. It simply tells the working system that the area is now accessible to be written to.

As well as, most desktop environments as we speak forestall you from immediately deleting recordsdata on disk. As an alternative, they’ll transfer the deleted file to the Trash folder (or the Recycle Bin in Home windows), which may then be simply restored.

You possibly can get better your recordsdata in Linux by accessing the Trash folder in your desktop.

Click on on Win then sort “The Information”.
Click on on enter “trash” on the left sidebar of the file supervisor.
Proper-click file which you wish to restore and choose “Restoration from Trash”.

Tip: You can even be certain that the file is unrecoverable by performing a correct safe deletion.

1. Testdisk

Testdisk It is likely one of the hottest Linux deleted file restoration instruments. It’s a highly effective peripheral program that may get better misplaced partitions from nearly any disk. It really works by going by way of every cylinder in your disk whereas searching for any partition desk information.

Which means Testdisk can restore the file system even after wiping it clear. This may also be helpful in instances the place you might have by accident formatted the disk and deleted its inner partition desk.

Set up Testdisk in Ubuntu and Debian by working the next command:
```
sudo apt set up testdisk
```
Enter sudo testdisk within the terminal window of your gadget to run this system.
Find “building” Tells Testdisk that you just wish to retailer the historical past of the present session.
Find tweak that you just wish to get better. In my case, it’s “/dev/sda.”
Find Partition desk sort in your disk.
Find “evaluation” To test the disk for any inconsistencies with Present part format.
Choose an possibility “Fast Search” to begin a course of part restoration.
Click on on Enter To just accept the default values for Testdisk.
Find “writing” To save lots of the brand new partition format.

Positives

Restores total disk partitions
Repairs disks with an unbootable working system

cons

Particular person recordsdata can’t be restored
Restoring a partition won’t assure that its contents are there

2. Photorec

Photorec It’s a easy software that may get better recordsdata by way of information sculpting in Linux. It’s a course of by which the software program reads the uncooked bytes of the disk to seek out the contents of the deleted file.

One of many greatest benefits of Photorec is that it’s usually bundled with Testdisk. You need not set up any extra utilities and dependencies to begin recovering recordsdata.

begin in Restore your information by working Photorec:
```
sudo photorec
```
Spotlight the disk containing the recordsdata you want to restore, after which choose “monitoring”.
Choose the choice “(Total Disc)”, Then press Enter.
Select the file system that originally saved the deleted file.
Save “Restoration Information” for photorec. To pick one, go to Information goal utilizing arrow keys then faucet C.

Positives

The restoration algorithm is quick
It handles all kinds of file system codecs

cons

Restoration can punish solid-state drives
Requires a separate file system to retailer recordsdata

3. Scalpel

Scalpel It’s quick and environment friendly software program that makes use of common expressions to get better any misplaced recordsdata in Linux disk. Just like Photorec, Scalpel goes by way of your disk and appears for any byte sample that might point out that there’s information current.

One benefit of Scalpel is that you need to use common expressions to set what this system will restore, so it solely takes a fraction of the time in comparison with comparable applications.

Set up Scalpel In Ubuntu and Debian by working the next command:
```
sudo apt set up scalpel
```
Copy the default configuration file for Scalpel To your private home listing:
```
cp /and so on/scalpel/scalpel.conf /house/$USER/
```
Open a file scalpel.conf Together with your textual content editor:
```
nano /house/$USER/scalpel.conf
```
Uncomment the strains containing File extensions that you just wish to get better.

Run Scalpel Utilizing the next command:

sudo scalpel -c /house/$USER/scalpel.conf -o /house/$USER/out /dev/sdb1

Positives

Works on each gadget recordsdata and disk pictures
It lets you filter the kind of file you wish to get better

cons

The configuration file could be complicated
It may be unreliable in detecting file varieties

4. ddrescue

ddrescue It’s a highly effective information restoration utility that makes use of clever algorithms to protect your complete contents of disk gadgets. Not like an information switch software, the first purpose of ddrescue is to get better and protect information as precisely as attainable.

By design, ddrescue doesn’t extract recordsdata from the disk file with this methodology. As an alternative, it creates a “snapshot” of the disk’s present state, which could be helpful in instances the place you are extracting information from a damaged and failing laborious drive.

You possibly can set up ddrescue In Ubuntu and Debian by working the next command:
```
sudo apt set up gddrescue
```
Begin preserving the contents of your disk. For instance, the next command will create a picture file from the disk gadget “/dev/sdb”:
```
sudo ddrescue /dev/sdb /house/$USER/sdb.img /house/$USER/sdb.map
```

Verify the integrity of your shot with the tag -I :

sudo ddrescue -I /dev/sdb /house/$USER/sdb.img /house/$USER/sdb.map

Positives

It creates an actual copy of your disk
Skips dangerous sectors on the laborious drive

cons

It won’t get better misplaced file immediately
It may be sluggish on massive laborious disks

5. Fatcat

Fatcat It’s a light-weight software program that may get better recordsdata inside FAT file programs in Linux. This contains the previous FAT12 format by way of to the newer FAT32 model. Fatcat could be a useful gizmo for recovering information from previous laborious disks.

Probably the greatest options of Fatcat is that it may be a transportable file explorer for FAT disks. You don’t want to extract a picture file to entry and restore its contents.

Set up Fatcat In Ubuntu and Debian by working the next command:
```
sudo apt set up fatcat
```

Create FAT partition picture file your utilizing ddrescue:

sudo ddrescue /dev/sdb1 /house/$USER/fats.img /house/$USER/fats.map

Confirm The contents of the FAT picture your personal by itemizing its root:
```
sudo fatcat /house/$USER/fats.img -l / -d
```
evacuation The contents of the FAT partition in your file system:
```
sudo fatcat /house/$USER/fats.img -x /house/$USER/output -d
```

Positives

It masses the contents of the FAT partition in a short time
Repairs damaged FAT file programs

cons

exFAT isn’t supported
Restoring particular person directories could be tough

6. Ntfsundelete

Ntfsundelete It’s a software that may restore and get better recordsdata in NTFS file programs on Linux. Just like Fatcat, Ntfsundelete can get better particular person recordsdata in addition to total directories and disks.

Ntfsundelete is current in most Linux distributions by default, as it’s included within the ntfs-3g package deal that acts as a compatibility layer for NTFS on Linux.

Create a picture file in your NTFS partition with ddrescue:

sudo ddrescue /dev/sdb1 /house/$USER/ntfs.img /house/$USER/ntfs.map

Take a look at the consistency of your picture file by itemizing its contents:
```
sudo ntfsundelete /house/$USER/ntfs.img
```
Get well information out of your disk picture. For instance, the next command will restore all ZIP recordsdata from a disk picture:
```
sudo ntfsundelete /house/$USER/ntfs.img -u -m '*.zip*' -d /house/$USER/output
```

Positives

A vital a part of most Linux distributions
Recovers particular person recordsdata

cons

Unreliable with gadget recordsdata
The names of the restored recordsdata might differ from the unique

7. Ext4magic

Aside from recovering recordsdata inside FAT and NTFS partitions, additionally it is attainable to get better recordsdata from Linux Ext file system. Put together Ext4magic Highly effective software program that may undelete nearly any file from Ext3 or Ext4 file system.

One among Ext4magic’s promoting factors is that it may possibly get better recordsdata utilizing date ranges. This may be helpful in instances the place you can’t keep in mind the precise file title and the unique file sort.

Set up Ext4magic In Ubuntu and Debian by working the next command:
```
sudo apt set up ext4magic
```

Create picture of a disk partition your utilizing ddrescue:

sudo ddrescue /dev/sdb1 /house/$USER/ext.img /house/$USER/ext.map

Get well deleted recordsdata utilizing ext4magic. For instance, the next command will restore all recordsdata in my Ext4 disk:
```
sudo ext4magic -M /house/$USER/ext.img
```

Positives

The journal file is used to assist restore recordsdata
Scans the file system for issues

cons

The date vary possibility makes use of the UNIX epoch format
It may be unreliable with older deleted recordsdata

Regularly Requested Questions

Q1. What can I do if Photorec nonetheless cannot discover my file after scanning?
Reply: In some instances, Photorec’s first restoration card might lose some necessary byte information. To repair this, choose the “Deep Search” possibility after the primary cross to inform Photorec to re-scan.

Q2. Is it okay to allow all file extension filters in Scalpel؟
Reply: Sure. Nonetheless, it’ll scale back the effectiveness of Scalpel, as some file format entries in “scalpel.conf” can produce many false positives. It is a good apply to allow solely the choices you want for a selected scan.

Q3. Why cannot I open my FAT picture file with Fatcat?
Reply: That is most definitely resulting from a mismatch between the picture file and the format that Fatcat expects. To repair this, run ddrescue on the partition containing the FAT file system as a substitute of your complete disk.

Learn additionally: Methods to view WebP pictures on Linux