How to Recover a Deleted File in Linux?

There is no doubt that the idea of losing an important file or deleting it unintentionally is certainly annoying and almost all of us have been in the same situation, especially if the files are very important, whether they are work files, personal photos or videos that you cannot do without and want to recover.

If you are exposed to this problem, do not worry. There are many solutions and programs dedicated to recovering files, especially if you are using the famous Linux distribution. There are also many diverse and free programs dedicated to all famous distributions.

Linux Programs for Recovering Data and Deleted Files

They are programs that recover lost, deleted, and damaged files when they are deleted by mistake or formatted and deleted from SSD Hard Disk storage devices and even other electronic devices that carry storage memory such as DVD discs, USB flash memory, and other discs or devices.

In this tutorial, we will explain one of the best tools, called TestDisk, alongside another one called Extundelete.

TestDisk

TestDisk is considered one of the best programs for recovering deleted photos, videos, files and damaged data. It is an open source tool that can recover all files, regardless of their type and size. It is also very excellent at recovering data from hard disks and USB. It also works excellently on Linux distributions and is also used in digital forensic investigations.

Install TestDisk in Linux

Since TestDisk doesn't come installed in Linux distribution you first need to install it on Ubuntu using the command ?

apt install testdisk

For Fedora ?

sudo dnf install testdisk

When you run TestDisk for the first time, you should see a screen like this ?

You are going to create a new log file by pressing Enter. If you didn't run TestDisk with sudo, this will bring up a screen asking you to enter the password.

After that, you should get a screen like this ?

Here, select the partition and hit Proceed. Make sure that the "Proceed" option is highlighted, as shown in the image.

Next, you will get a screen like this ?

This screen asks you to select the partition type. In this case, it will be Intel, so press Enter.

The next screen will look like this ?

Here, if you have a damaged disk, you should proceed with the Analyze option to fix it. But if you just need the recovery process, select the Advanced option, and you will get a screen like this ?

Select the Image Creation option and hit Enter.

After this, it will give you a screen to select where to save the restored data, like this ?

Use the arrow keys to set the location, and hit C when you are in the right place.

After that, the recovery process should start, and you'll see a screen like this ?

Finally, once the recovery is done, run this command in the location where you saved the data ?

testdisk image.dd

This will show you all the recovered data.

Extundelete Tool

This command tool is useful when you work on the terminal and, by mistake, forget and delete a file using the command rm. If this is the case, the Extundelete tool can restore it to its original location.

Compared to Testdisk, I prefer using Extundelete as it is fast, straightforward and has almost the same functionality (but not all) as test disk.

Just like Testdisk, Extundelete tool doesn't come installed by default, you will need to install it first.

For Ubuntu / Mint ?

sudo apt install extundelete

For Fedora ?

sudo dnf install extundelete

When you delete something in Linux, especially if it is a large file, the first step is to unmount the partition. This prevents writing more data to the location where your file was located (which could overwrite the deleted data).

To unmount a partition, use the command ?

sudo umount /dev/sda2

In this example, the deleted file is on /dev/sda2.

To identify the partitions on your system, use the command lsblk. For example, on my system, it looks like this ?

After unmounting, the usage of the tool is very simple.

Let's do an example where I deleted a file called test located in the home folder.

To restore a specific file using extundelete, use the command ?

extundelete /dev/sda1 --restore-file /path/to/deleted/file

We use the option /dev/sda2 to specify the partition where the file was located, followed by --restore-file to indicate that we want to restore a file, and then the path of the file we want to recover. For example ?

sudo extundelete /dev/sda2 --restore-file ~/test

This will recover the file test, which is in the partition /dev/sda2.

Conclusion

In this tutorial, we explained how to restore deleted data from the hard drive using TestDisk and Extundelete.

We first started with TestDisk, which is a well-known and powerful tool with many functionalities. However, in this article, we explained only how to use it to restore data from a specific disk. Lastly, we provided an example of how to use Extundelete to restore a file.