How to recover deleted files?

TestDisk / PhotoRec

TestDisk can sometimes recover recently deleted files using PhotoRec, which is part of TestDisk. Available on official repo and newer version on their site.

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

PhotoRec is part of TestDisk, and is a file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

I have used foremost to recover damaged hard disk both under NTFS (windows), FAT32 (Flashcard from a Nokia phone), and ext3 with great results. Command-line only, but quite it's easy, something like this:

sudo foremost -i /dev/sda -o <dir where recovered files will be stored>

It will order the recovered files on folders by file-type. Openoffice docs are recovered as zip files. As you need to execute it as root (in order to directly access the hardware), output files are also owned by root, so you will likely need to change their ownership afterward.

extundelete is really great if your file system is ext3 or ext4.

Note: extundelete requires you to unmount your drive to work properly (this is a good idea to do ASAP anyway, to avoid potentially overwriting the hopefully-recoverable bytes in the deleted files).

Unmounting the drive on a live system can be tricky... you'll often get the 'device is busy' message. To clear this 'properly' requires shutting down all processes accessing the file system. But... you were likely working in your home directory, and a zillion processes are hooked into your home directory, so good luck with that.

The trick to getting around this is to do a 'lazy' unmount:

$ mount
/dev/sda7 on /home type ext4 (rw)
$ sudo umount -l /home

where:

• that example is for me prepping my /home mount for use with extundelete. You obviously need to replace /home with your mount of interest
• I did the mount command first to figure out what device (/dev/sda7) I need to pass to extundelete (output is truncated for brevity)
• that is a lower case L in the -l option

If you deleted some file by accident but still know some strings which were written in that file you can use:

grep -a -B 25 -A 100 'containing string' /dev/sda1 > result.txt

To recover the directory you can use extundelete

1. Install extundelete

   sudo apt-get install extundelete
   

2. Command to recover

   sudo extundelete --restore-directory /home/Documents/ /dev/sda1
   

Note: In place of dev/sda1 put your hardisk partition name.

/home/Documents/ is your path to deleted directiory.

R-Linux(Recovery studio) is one of the best. I have used this tool many times before. I worked at a company where they used the commercial version, 9/10 times it recovers everything you want. Truly superb application. I saved mine and my friends behind many times before.

R-Linux is a free file recovery utility for the Ext2/Ext3/Ext4 FS file system used in the Linux OS and several Unixes. R-Linux uses the same InteligentScan technology as R-Studio, and flexible parameter settings to provide the fastest and most reliable file recovery for the Linux platform. However, unlike R-Studio, R-Linux cannot recover data over a network or reconstruct RAIDs, or provide object copy.

Features (from their website):

R-Linux recover files:

• Removed by virus attack, power failure, or system crash;
• After the partition with the files was reformatted, damaged, or deleted;
• When the partition structure on a disk was changed or damaged. In this case, R-Linux can scan the disk trying to find previously existing partitions and restore files from found partitions.
• From disks with bad sectors. In this case, R-Linux can first copy the entire disk or its part into an image file and then process the image file. This is especially useful when new bad sectors are constantly appearing on the disk, and the remaining information must be immediately saved.

R-Linux Advanced features:

• Standard "Windows Explorer" - style interface.

• Host OS:

  • Linux variant: Linux, kernel 2.6 and above
  • Windows variant: Win2000, XP, 2003, Vista, Windows 7, Windows 8

• Supported file systems: Ext2/Ext3/Ext4 FS (Linux) only.

• Recognition and parsing Dynamic (Windows 2000/XP/Vista/Win7), Basic, GPT, and BSD (UNIX) partitions layout schema and Apple partition map. Dynamic partitions over GPT are supported as well as dynamic partitions over MBR.

• Creates image files for an entire hard drive, logical disk, or its part. Such image files can be processed like regular disks. Images can be either simple exact object copies (Plain images) compatible with the old versions of R-Linux, or compressed images that can be compressed, split into several parts, and password-protected. Such images are fully compatible with the images created by R-Drive Image, but incompatible with the old versions of R-Linux.

• Recognizes localized names.

• Recovered files can be saved on any (including network) disks accessible by the host operating system.

Try Scalpel

sudo apt-get install scalpel

for more info

man scalpel

If using secondary internal HD (suspect the same for external HD) for recovered file import (from main HD, where the files originally were), it’s necessary to make a directory, into which the files will be put in on secondary HD. To do it, you need to have BIOS setting for booting from CD first! 1. Start Live Ubuntu Rescue-Remix CD, give command to boot, then when it boots into terminal, check your HDs by command – Code: sudo fdisk -l

Realize what HD is main, and which is secondary, and what partition to check for files and into which to recover them – linux ext3 or Windows NTFS! Mine was Linux. Have enough room on it! (Then you can try to run Photorec (“sudo photorec”) and hopefully you’ll be able to see all your HDs. I was not that lucky, so I had to make directory and mount sec. HD.)

2. Make directory for recovered files first, e.g. – media/disk. Give command – Code: sudo mkdir /media/disk

If alright, terminal prompt simply returns.

3. Must mount secondary HD, or it’ll be invisible, even if “sudo fdisk -l” does show it. Give command for your secondary HD – Code: sudo mount -t ext3 /dev/sdb2 /media/disk

If alright, terminal prompt simply returns.

4. Run Photorec by command – Code:

   sudo photorec

Go thru settings, and only choose file types that you want, otherwise you’ll have thousands of files to sift thru!

For more details you may please visit: http:/www..ubuntumanual.org/posts/357/recover-your-deleted-files-in-ubuntu

Autopsy and the Sleuthkit tools are great for recovering deleted files, with a user-friendly UI, as well as being available in the repos:

sudo apt install autopsy

Install scalpel

sudo apt-get install scalpel

Edit the scalpel.conf file and uncomment the file types you want to recover. Create an empty folder (eg:recovered_data) Find the partition your data was. You can use lsblk to get the partition map.

sudo lsblk

Run scalpel (assume the data was in sda1)

sudo scalpel -o recovered_data/ /dev/sda1