How to Recover Permanently Deleted Files In Linux

recover/restore deleted files in linux

Did this ever happen to you? Accidentally or intentionally on your system using Shift+Delete or delete option or empty Trash. After that you get that horrible feeling when you realize that you permanently delete your files and it’s not even in the trash.

Don’t worry! We all know the feeling of losing a file. But the file content is not destroyed from the hard disk (or any storage media), and YES you can probably still restore it as long as that area of disk has not yet been overwritten.

There are various tools available through which you can get your deleted files back. Most of these tools recover the deleted files from the previous images (memory state) of your Linux system.

In this tutorial, we will shows you how to recover your deleted files on a hard disk (or any storage media) in Linux using two of most powerful tools these days, Foremost and TestDisk.

Recover Deleted Files In Linux with Foremost

Foremost is able to search a disk or raw image file to recover files based on their headers, footers, and internal data structures. Foremost is available in many different Linux distros, such as Mint, Debian, Ubuntu etc.

Step 1: Install Foremost

Open your terminal either by using the Ctrl+Alt+T keyboard shortcut or by clicking on the terminal icon.

You can install Foremost in Linux Mint, Debian, or Ubuntu by simply running the following command in terminal.

CentOS/RHEL

By default Foremost is not available in any of the standard CentOS/RHEL repositories, so we’ll install it directly from the RPM.

Optionally you can download the Foremost source here.

The Scenario

In this scenario we are using CentOS 7, however once you’ve installed Foremost the rest of the steps should be the same in any Linux distros.

Now that Foremost is installed, let’s delete a file. It’s worth noting that Foremost does not need to be installed when the file was deleted, that’s just the order I happened to do things in.

In this example we will be removing the image file (.jpg) file shown below.

We’ll use this information later to verify that the file has been successfully restored. Now we’ll delete the file using the rm command.

Step 2: Recover Deleted File

Next we’ll create a directory to recover our files to. Foremost requires an empty directory for this purpose, so we’ll make /root/restored/.

Now we are ready to run the Foremost command and restore our image file. The -i switch is used to specify the disk or image file that we want to search, while -t is used to restore files of the type specified. Foremost supports many different types of files. This is required as foremost searches the disk based on the headers which that type of file uses.

The recovery process it lasted approximately 3 minutes to complete on an 32GB SSD disk. This will find any .jpg files in /dev/sda3 and restore them into the /root/restored/ directory, as long as the space they are using on disk has not yet been overwritten by anything else.

If we look inside our /root/ restored directory, we can see that our image file has successfully been restored. The md5 hash of the file is exactly the same as the file before we deleted it.

NOTE: As file names are not stored within the file itself it is not possible to restore the file with the original file name, however the data is all there.

Recover Deleted Files In Linux with TestDisk

TestDisk is a free data recovery software designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error. It can also be used to repair some filesystem errors.

In this scenario we are using Ubuntu 18.04, however most Linux distros already have this tool in their official repository.

Step 1: Install TestDisk

Open your terminal either by using the Ctrl+Alt+T keyboard shortcut or by clicking on the terminal icon.

In order to install TestDisk utility in Ubuntu, (also in Linux Mint or elementary OS), just run the following command in terminal as sudo:

Optionally for other Linux distributions you can download the TestDisk here.

Step 2: Run TestDisk utility

Run TestDisk in the terminal using the following command below:

When you open it, the output will give you a description of the utility and you’ll see something that looks like this.

testdisk-ubuntu

Use the arrow keys to navigate and press Enter to select.

NOTE: TestDisk 7.0 tends to highlight the next reasonable step. It’s almost always right but do read the screen, since it can’t read your mind. In any case, when it wants you to let it create a log file, indulge it. It’s about to pull you out of a hole.

Step 3: Select your recovery drive

The utility will now display a list of storage drives attached to your system. In this example, it is showing primary hard drive as it is the only storage device on this system. You’ll see something like this:

Select “Proceed” and hit “Enter” to create another log file.

Step 4: Select Partition Table Type of your Selected Drive

After you selected a drive, you need to specify its partition table type and you’ll see something like this:

TestDisk utility will automatically highlight the correct choice. Press Enter and continue.

Step 5: Select ‘Advanced’ to recover deleted file

After yo specified the correct drive and its partition type, you’ll see something like this:

Step 6: Select the drive partition where you lost the file

If your selected drive has multiple partitions, you’ll see something like this:

On this screen you can choose the relevant one from them and press List and that will list all the directories on your partition.

Step 7: Browse to the directory from where you lost the file

TestDisk will scan for files and produce a list of deleted files highlighted in red. Arrow down to it and carefully read the choices at the bottom.

Step 8: Copy the deleted file to be recovered

By now, you must have also found your lost file in the list. Use the C option to copy the selected file. This file will later be restored to the location you will specify in the next step.

Step 9: Specify the location where the found file will be recovered

You can specify any accessible location as it is only a simple UI thing to copy and paste the file to your desired location.

Step 10: Copy/recover the file to the selected location

After making the selection about where you want to restore the file, click the c button and this will recover your file to that location:

Congratulations! You finally recover your recently deleted file.

That’s all! In this tutorial, we explained the necessary steps to recover deleted or lost files from hard disk using Foremost and TestDisk utility. This is so far the most reliable and effective recovery tools we have ever used, if you know any other similar tool, do share with us in the comments section bellow.

3 Comments

  1. If you can restore a deleted file, then it’s not *permanently* deleted, is it? 🙂

    When you delete a file, the inode and the blocks where the data is stored are marked as unused so that this inode number and data blocks can be reused. No data is actually deleted.

  2. Hi
    thanks for pointing out these apps. I was looking for something like this since a while.
    However, foremost looks very promising, but does not support, as far as I can see,
    extensions such as tex, el, (emacs lisp) odt, docx

    testdisk, for me, just tries to create an image but does not list deleted files.

    regards

    Uwe Brauer

Leave a Reply

Your email address will not be published. Required fields are marked *