Today, most Linux distributions are even easier to install and use than Windows. And yet, when you find yourself troubleshooting a broken driver installation or, as we’ll see in this article, need to recover deleted files on Linux, the friendly face of Tux’s OS might seem like a façade.
Although it’s possible, data recovery on Linux is more complicated than on Windows, since most tools for such tasks run in the terminal. But don’t fret, that’s where we come in with the following detailed guide. So, read on to find out how you can get your files back on Linux.
Can You Recover Deleted files In Linux?
After they’re gone, you can restore deleted files on Linux, but the process is more complex than on Windows. In the most favorable scenarios, you can undelete Linux files by finding them in the Trash directory. However, it’s much more probable you’ll have to use more advanced tools in the terminal.
In this article, we’ll see how you can easily use such data recovery solutions, primarily for the common EXT family of file systems. The same tools usually also support the most popular Windows file systems, FAT32, NTFS, and exFAT, since they’re often found on removable drives like memory cards you might be accessing from Linux.
Still, with limited time and space, we can’t go over every possible case. Today, if you’re using one of the popular Linux distributions, like Ubuntu, Mint, CentOS 7 etc., and went with their defaults, you’re probably using EXT3 or EXT4. But it’s not a given.
You might be using a file system like ZFS, ReiserFS, or BTRFS, that offer extra features for ensuring your data’s security and health. However, to complicate things further, those features, too, can be optional.
So, we’ll skip those for this article since you might have to use specialized tools to reap better results on such file systems.
If you aren’t using EXT3 or EXT4 or would like to have even more options than the software we’re using in this article, check our guide on the best open-source data recovery software.
Things to Keep in Mind Before You Begin Linux File Recovery
Every single write to the storage device from which you are trying to recover data reduces your chances of getting that data back in usable condition.
That’s why you should unmount the partition from which you want to undelete Linux files and mount it back as read-only before any attempt to recover deleted files on Linux.
If you want to recover data from your root partition, which contains all the files and directories of your Linux OS installation, it’s impossible to unmount it while “inside” the running OS. In such a scenario, you can boot your PC from a live CD or USB drive to scan your root partition. The methods we see in this article should largely remain the same when using your actual Linux installation or a live environment.
You can do that by using the following commands:
sudo umount /dev/sdc2
sudo mkdir /media/device-to-scan
sudo mount -o ro /dev/sdc2 /media/device-to-scan
To disassemble those into their parts:
- sudo is the terminal command for executing other commands as an administrator (“root”).
- umount unmounts the “second partition (2) of the third device (sdc)”.
- mkdir creates the directory “/media/device-to-scan“, which can then be used as the mount point for remounting the device.
- mount -o ro mounts the device “/dev/sdc2” to the directory “/media/device-to-scan” as read-only.
To be even safer, it’s best to clone the device you want to scan to another device or an image file.
To do that, use the dd command:
sudo dd if=/PATH/TO/SOURCE/DEVICE of=/dev/PATH/TO/TARGET/DEVICE/OR/IMAGE
For example, let’s say we want to clone the second partition of the third storage device into the “backup.img” backup image stored directly in our home folder. The command for that would be:
sudo dd if=/dev/sdc2 of=$HOME/backup.img
Alternatively, you can use a solution like CloneZilla, for which you can read more in our article on the best backup and recovery software.
By having a backup, even if your storage device fails before you manage to recover files on Linux, you’ll still have them safe in the cloned image.
If all this already sounds like “too much”, and you’d prefer a more straightforward (and click-friendly) solution, check our article on the best data recovery apps.
How to Recover Deleted Files On Linux
Most Linux distributions originate from a handful of “parent” distributions. Although they’re (mostly) similar and compatible, they also have some differences. They might use their own directory structure, tools, etc.
So, even if you seek Ubuntu data recovery software, the apps you’ll find are actually compatible (and available) with all Linux distributions.
Still, this article will look at how you can recover deleted files on Ubuntu and other distributions based on Debian, like Linux Mint. Expect minor variations to what you’ll see here if using a distribution from a different “family”, like SUSE, Arch Linux, etc.
Method 1: Retrieve Deleted Files From Trash
Like Windows’ Recycle Bin, Linux’s Trash is a system-level folder where all deleted files are moved temporarily for a predefined period. If you get to them before this time runs out, you can restore deleted files on Linux without using the terminal or third-party software.
In modern Linux distributions, the Trash folder is usually accessible directly from your desktop.
For example, to get your files back out of the Trash folder on Ubuntu:
- Click on the trashcan icon on Ubuntu’s toolbar to access the contents of the Trash folder using the default file manager.
- Select the files or folders you want to recover, right-click on them, and select Restore from Trash.
Method 2: Repair Corrupted Partition Using TestDisk
Is it not a handful of files you are missing, but all of them? Does the device or partition where they were stored appear as empty, RAW, or otherwise inaccessible? Then, you don’t need to recover files on Linux individually but to check and fix file system errors. And TestDisk can help with that.
TestDisk can analyze most storage devices, from internal hard disk drives to the SD cards you use with your camera. It can locate and recover, fix, or rebuild the most popular file systems, from Linux’s native family of EXT filesystems to FAT32 and NTFS as used on Windows. To learn more about the app, check our in-depth TestDisk review.
Is a corrupted data structure the only problem that rendered your data inaccessible? After TestDisk is done, the disk you “fix” with it – and all your files on it – should be accessible again.
To fix a corrupted storage device with TestDisk on Ubuntu, Mint, or any other Debian-based Linux distribution:
- If TestDisk wasn’t bundled with your distribution, install it using the command sudo apt install testdisk.
- Run the app with sudo testdisk in your terminal. Select Create to create a new log file, which may help with troubleshooting if things don’t go as intended.
- Use the up and down cursor keys to highlight the device you want to scan from TestDisk’s media list and the left and right cursor keys to highlight Proceed, followed by Enter.
- Select the correct partition table type for your device. In most cases, you should go for Intel.
- Select Analyze and press Enter to check your storage device for lost partitions.
- TestDisk will show you the current partition structure. Highlight Quick Search and press Enter to look for more.
- TestDisk found only one partition on our drive, but it might locate more on yours. Highlight the correct partition and hit Enter to continue.
- TestDisk will show you the new partition table. If you are happy with it, highlight Write and press Enter.
- If you are sure you want to write the new partition table to the device, answer positively when asked about it.
- If, for some reason, TestDisk can’t apply the necessary changes to your device, it will inform you that a reboot is needed.
Method 3: Recover Permanently Deleted Files With PhotoRec
Were the contents of a folder accidentally deleted using the rm -rf command? There’s no “undo rm” button that can bring everything back to how it was, but you may save most of your lost files as long as you act quickly. Your files won’t be gone until they’re overwritten. And PhotoRec, which we’ve reviewed in the past, can find them.
PhotoRec is bundled with TestDisk, which we’ve covered above, so we’ll skip its installation. As you’ll see in action, both apps are similar but achieve different goals.
Master PhotoRec for recovering files deleted by rm -rf with these steps:
- After you install TestDisk, you’ll also have PhotoRec available. So, launch it from your terminal with sudo photorec.
- From PhotoRec’s media list, select the device you want to scan for lost files. Highlight Proceed and hit Enter.
- Highlight the partition you want to scan (in our case, there was only one), and with Search selected, press Enter.
- Choose the correct filesystem type for the device. Go for ext2/ext3 for the EXT family of Linux filesystems (including the latest, EXT4), or Other for any other filesystem. “Other” covers non-EXT Linux filesystems (like ReiserFS) and those primarily used on other OSes, like the Mac-friendly HFS+ or Windows’ FAT32 & NTFS.
- Choose Free if you want to quickly scan only the unallocated space for lost data, or Whole for seeking files on the whole device with a more thorough but slower scan.
- Select a destination directory where PhotoRec will store the recovered files. You can navigate the list with the up and down cursor keys. You can enter a highlighted directory by pressing Enter and return to the previous level by selecting the two dots at the top of the list. When you’re “in” the folder where you want to store the recovered files, press C.
- PhotoRec will first analyze the filesystem.
- Then, it will start recovering any files it finds to the destination folder you selected.
- PhotoRec will inform you about the outcome of the process, giving you a single option to select: Quit.
- You’ll find your files in the directory you selected as the recovery’s destination.
Unfortunately, if you find thousands of nonsensically-named files dumped in the destination folder, that’s the nature of PhotoRec. The app doesn’t recover the original file names or any folder structure.
Another issue is that although PhotoRec supports an impressive range of file types, it’s still limited compared to many other data recovery solutions. So, it may be unable to locate unpopular file types.
Method 4: Undelete Linux Files Using Foremost
Foremost is one of the most versatile and customizable data recovery solutions. Since it’s open source, it’s also free to use.
As it’s primarily a tool for professionals, Foremost is far from the most user-friendly piece of software.
Still, if you don’t need the app’s advanced functionality, a simple data recovery with Foremost is relatively straightforward:
- Foremost isn’t bundled with most Linux distributions but should be available in their repositories. To install it from there, fire up your terminal and use the command sudo apt install foremost.
- Create a folder where you want to store your recovered files (you can use the command mkdir), and then enter it (using the command cd).
- Launch Foremost using the command sudo foremost-i /device/you/want/to/scan. For example, to recover deleted files on Linux from the first partition of the second storage device, use the command sudo foremost-i /dev/sdb1.
- Give Foremost some time to scan your disk for lost data.
- Foremost will start saving inside the directory you created, every deleted file it locates on the device it’s scanning.
- When it’s done, you will find all the files it recovered within that folder.
- By default, Foremost will try to save every lost file it locates. Do you only want to undelete Linux files of a particular file type, for example, txt and doc files? Instruct Foremost only to seek specific file extensions using the “-t” flag, like sudo foremost-t txt,doc -i /dev/sdb1.
Other Notable Tools For Linux File Recovery
Linux is known for offering many solutions for any task, and data recovery isn’t an exception.
Thus, if you’d like more alternatives with which you can recover deleted files on Linux, the following are some of the most popular and trusted solutions worth checking out.
- Mondo Rescue is one of the most powerful data recovery solutions. Mondo Rescue supports various storage devices, from tapes to optical media, many popular file systems, RAID setups, and much more.
- DDrescue was designed as a fully automatic data recovery solution. The app allows you to recover data from any storage device detected by the Linux kernel without micromanaging the process. Unlike many of its peers, DDrescue can prioritize the “most recoverable” data to ensure you get as many files as possible from a failing device.
- Extundelete, as its name suggests, specializes on can recover files on Linux that were stored using an EXT file system. It can recover both the contents and the filenames of lost files and is very fast, thanks to using the filesystem’s journal instead of scanning the whole storage before recovery.
- R-Linux: r-tool technology’s solution for Linux distributions is fast, reliable, and relatively user-friendly. However, it only supports the EXT family of file systems.
- Scalpel: An advanced data recovery solution, Scalpel is actually a “file carving and indexing” solution. Thanks to its support for multithreading and asynchronous I/O, it’s blazing-fast, and can even take advantage of the GPU to further boost its performance.
FAQ
Normally deleted files are temporarily moved to the Trash folder for a user-configurable amount of time or until the storage space they occupy is needed to store new data.
Files removed using the rm-rf command or any other method that skips the Trash are immediately marked as gone, and their space as available for use by other files. In such a scenario, it’s crucial to act quickly: if they get overwritten, it will be impossible to get them back.
There’s no way to recover permanently deleted files – for that’s what “permanently” means. More often than not, though, files marked as “deleted” aren’t gone until they’re overwritten.
To get such files back using PhotoRec:
- Install PhotoRec with sudo apt install testdisk.
- Run PhotoRec with sudo photorec.
- Select the drive to scan from PhotoRec’s media list and pick the correct filesystem for it.
- Choose a destination directory for saving the recovered files, and start PhotoRec’s scanning process.
- When PhotoRec’s done, you’ll find your files in that folder.
The rm and, by extension, the rm -rf commands skip the Trash folder. However, you might still be able to use a data recovery solution, like DDrescue or Foremost, as an “undo rm” fix.
For example, to recover deleted files on Ubuntu using Foremost:
- Install Foremost with sudo apt install foremost.
- Create a folder where you want to store the recovered data, and “enter it” from your terminal (using the command cd /path/to/folder).
- Use sudo foremost -i /device/with/deleted/files to have Foremost scan that device for lost data and save all located files to the current directory.
Conclusion
As we saw in this article, it’s possible to recover deleted files on Linux. Many solutions can help you, from mostly automated apps to advanced forensic tools. Best of all, thanks to being open-source, most of them are free to use.
Still, many factors can affect the outcome of any attempt to undelete Linux files, like the method used for deletion, the underlying file system, etc. To maximize your chances of getting your accidentally deleted files back, act as soon as you realize they’re gone and not a minute later.
This article was written by Odysseas Kourafalos, a Editor-in-Chief at Handy Recovery. It was also verified for technical accuracy by Andrey Vasilyev, our editorial advisor.
Curious about our content creation process? Take a look at our Editor Guidelines.