Ours among strangers: we recover data from FAT, NTFS and UFS without leaving Linux. How to recover a deleted file in Linux Linux recover deleted files with full paths
Ext2/3/4FS (created in Linux or other OS), FAT12, FAT16, FAT32, NTFS, NTFS5 (created or modified in Windows 2000/XP/2003/Vista/7/8), exFAT, ReFS, APFS, HFS+, HFSX, HFS and UFS1, UFS2, UFS BigEndian (used in FreeBSD, OpenBSD and NetBSD OS).
Support for standard RAID levels: volume set, 0, 1, 4, 5, 6. Support for nested and non-standard RAID levels: 10(1+0), 1E, 5E, 5EE, 6E. Parity delay support for all relevant RAID levels. Support for custom RAID schemes.
Automatic recognition of RAID parameters. R-Studio is capable of recognizing all parameters for RAID 5 and 6. This allows the user to solve one of the most difficult tasks when restoring a RAID - determining its parameters.
New improved algorithm for recovering files by their signatures: this function allows you to recognize the typical characteristics of the structures of common file types and recover data from devices on which the file system is damaged or unknown (HDD, CD, DVD, floppy disks, USB drives, ZIP drives, flash drives -memory (Compact Flash Card, memory sticks) and other removable media).
Custom known file types. The user can create and add new types of files of any complexity to R-Studio for their precise identification.
Supported Operating Systems: files can be recovered on Win2000, XP, Vista, Win7, Win8, Mac OS X or Linux and certain UNIX platform operating systems.
Almost all R-Studio files (images, scan information, logs, etc.) can be saved and loaded over the network.
Optimization of the data recovery process: to increase the recovery speed and reduce the amount of data transferred over the network, the file analysis and recovery process is performed on a serviced computer with damaged/deleted disks. You can also save the recovered files on a disk on the same computer.
Creating an image file: using R-Studio you can create an image file of an entire physical disk, logical disk or partition. Such images are exact copies of objects and are compatible with all previous versions of R-Studio.
Additional features when creating an image file (another image file format): images can be divided into several parts, compressed and password protected. They are only compatible with current versions of R-Studio and the R-Drive Image program.
You can create an image and scan the copied data at the same time.
Disk copy module: byte-by-byte copying of any object in the Drives panel is possible, as well as copying partitions and hard drives with changing their parameters.
Hexadecimal disk and file editor: Supports storing non-resident NTFS file attribute. Allows you to analyze data and present it in accordance with various data templates (including custom ones). Files located in specific sectors are also shown.
R-Studio Emergency boot device. R-Studio Emergency runs from an external USB drive, CD/DVD or a set of floppy disks. This is very useful when you need to recover data from a computer that cannot boot due to file system corruption.
Viewing the contents of files: to view the contents of the restored file, simply double-click on it. Very useful in assessing chances of recovery. An efficient built-in file viewer that displays pictures as tiles and the first frames of video files as icons and supports a large number of . Now these files can be played without the corresponding programs installed.
Monitoring S.M.A.R.T. parameters R-Studio can display S.M.A.R.T. parameters. (Self-Monitoring, Analysis and Reporting Technology) for hard drives that show the state of their hardware and predict their possible failures. Any additional load on such disks should be avoided if warnings from the S.M.A.R.T system appear. Hard drive icons in Drive View (Disks panel) are used to show the overall S.M.A.R.T. status. for disks.
ABOUT recovering data from file systems Linux didn't write only
lazy. To accomplish this task, there are many different
tools, including the debugfs utility, which easily removes any worn
files with ext2. But what about other FS? How to recover a missing file from
flash keychain or a nearby NTFS partition? Even the most silent about this
hardworking bloggers. Meanwhile, everything is very simple and prosaic.
It is not always convenient to reboot into another operating system to perform
actions to check file systems, restore files, resize
partitions and perform other operations with data. Imagine that it's already been a few
For years, two operating systems have been installed on your computer: Windows and Linux. First
you download very rarely and only in emergencies, you use the second one
every day and you’re already thinking about completely switching to Linux and uninstalling Windows, so
Convert only the NTFS partition, which stores years of accumulated data, to ext3
cannot be done with any tools. You have to keep two operating systems because
although the NTFS partition is accessible from Linux (using ntfs-3g), to solve problems
The file system will still have to be rebooted into Windows.
What if the FAT file system on the Flash drive is damaged? Again
reboot into Windows? Or you accidentally deleted a file on the UFS file system,
belonging to a nearby FreeBSD installation? Maybe you're a systemic
administrator, and there was no Windows recovery disk available at the right time
at hand? I will answer all questions at once: almost all actions upon returning from
non-existence of FAT, NTFS, UFS file systems, recovery of files stored in them,
diagnostics and much more can be done without leaving Linux. From this article
you will learn how to do it.
Set of tools
Before proceeding directly to the description of the recovery process,
diagnostics and bringing dead files back to life, I consider it my duty to familiarize
you with a list of tools used. Firstly, we will need
tools for working with file systems (creating, checking, getting
information). All of them are distributed in three packages:
1. dosftools- utilities for working with FAT file systems.
The package contains only two programs: mkfs.vfat (mkfs.dos) for creating a file
system and fsck.vfat (fsck.dos) to perform a file system check.
2. ufsutils- a set of utilities for working with UFS and derivatives (for example,
FFS used by FreeBSD). Contains eight utilities, including mkfs.ufs,
fsck.ufs, tunefs.ufs (FS settings), growfs.ufs (resizing) and others.
3. ntfsprogs- various utilities for working with NTFS. Does not contain
programs for creating or fully checking (basic checking is possible) file
system, but includes a lot of useful tools, such as ntfscp for
copying files without mounting the partition, "reincarnator" of ntfsundelete files,
utility for resizing partition ntfsresize, cloning program
ntfsclone partitions and others.
We may also need tools for working with hard disk partitions.
disk. There are three most advanced programs of this type:
parted,
designed to create partitions, resize them, move them,
creating and checking file systems;
gpart-
recovery program for a worn-out partition table and
TestDisk -
an analogue of gpart with a pseudo-graphical interface and several useful functions.
It should be noted that parted is just a nice wrapper on top of the described utilities
to work with file systems, so almost everything that parted can do can also
They. Moreover, around parted itself there is another wrapper called
. She
it just creates a convenient graphical GTK interface in the Partition Magic style.
In the TestDisk package you will find the PhotoRec utility, designed for
recovering various types of files from a partition, regardless of the type used
file system. The principle of its operation is to search and restore files
based on their metadata without analyzing the file system structure. PhotoRec is capable
recover images (bmp, jpg, png, tiff, raf, raw, rdc, x3f, crw, ctg,
orf, mrw), audio files (wav, au, mp3, wma), video files (avi, mov, mpg), archives
(bz2, tar, zip), documents (doc, pdf, html, rtf), files with program sources (c,
pl, sh). A number of programs of the same type can be found in the package
Sleuth Kit for which
There is an autopsy web interface.
Use cases
In the following sections we will look at several common scenarios
use of the described utilities. First, this is a detailed description of the process
recovering files using three different approaches, secondly, repairing
file systems after a failure, thirdly, cloning a partition on several machines,
fourthly, a description of the process of transferring data to a smaller partition.
Castim ressurection
To revive dead files on NTFS, the already mentioned
ntfsundelete from the ntfsprogs package. It is very easy to use and extremely
neat. If you accidentally lost a file and immediately unmounted the partition, be
I'm sure ntfsundelete will be able to return it to its place safe and sound.
First you need to view a list of all deleted files:
# ntfsundelete /dev/sda1
The third column of the output will indicate the percentage of file integrity. If he
equal to 100% - everything is ok, the file can be brought back to life unharmed;
a lower value indicates that some parts of it have already been erased
new data, so after recovery the file will appear, as they say,
beaten. In some cases, it is possible to restore even half-killed
file can make a difference, for now let’s focus on completely intact copies.
To do this, run the following command:
# ntfsundelete -p 100 /dev/sda1
Wow, there are so many of them! Let's force the program to display only the files
deleted in the last 2 days:
# ntfsundelete /dev/sda1 -p 100 -t 2d
That's better. Let's restore the file whose inode number (first output column)
is equal to 11172, in the /undeleted directory:
# ntfsundelete /dev/sda1 -u -i 11172 -d /undeleted
Files can be restored using a mask:
# ntfsundelete /dev/sda1 -u -m "*.doc"
Filter by length:
# ntfsundelete /dev/hda1 -S 5k-6m
Or you can restore all deleted files, and only then figure out
what is what:
# ntfsundelete /dev/sda1 -u -m "*" -d /undeleted
The program extracts files with all attributes, including name and creation time.
It's a pleasure to use.
To recover data from all other file systems, including FAT, UFS,
EXT3, and any others, it is most convenient to use PhotoRec. Let's launch
program:
In the main menu, select the experimental device (for example, /dev/sda). Click
partition, and on the next screen - the file system type (ext2/ext3 or other).
We set the directory where we want to place the recovered files and press "Y".
The directory must be on another partition/disk, otherwise you risk aggravating
situation by overwriting deleted files with new data.
That's it, the recovery process has begun, it can last from 10 minutes to
several hours, depending on the "oldness" of the file system and the number
deleted files. You can stop the process at any time by pressing
resume it from where it was interrupted by running PhotoRec again.
In the directory you choose, you will find a lot of subdirectories with names like
recup_dir.1, recup_dir.2, each of which contains a large number of files
different types. PhotoRec does not restore names, so you will have to tinker with
clearing out this whole heap.
PhotoRec has other disadvantages:
- Quite often it crashes and files may become damaged,
therefore, they should be checked for “unbrokenness” without fail. - The program searches for files using patterns. If you deleted a file whose format
PhotoRec is not supported - it's a lost cause.
Therefore, in addition to photorec, it is necessary to have other means on hand
analysis and recovery of lost data. Considered the best in this field
Sleuth Kit utility kit,
containing a huge number of a wide variety of instruments that people love
use various services to investigate hacking incidents and
advanced system administrators. We are far from this, and we are interested
only two utilities from the entire set: fls and icat, designed for searching and
retrieving files (both existing and deleted).
Let's view the list of deleted files using the fls utility:
# fls -rd /dev/sdb1
r/r * 117: dsc0005.jpg
r/r * 119: dsc0006.jpg
r/r * 122: dsc0007.jpg
r/r * 125: dsc0008.jpg
r/r * 128: dsc0009.jpg
The "-r" flag causes the program to recursively traverse all directories, while the "-d" flag
- show only deleted files.
Most likely, the listing will be very long, and will also contain a list
inode that have already been allocated to other files (the realloc line in the third
column), so we will filter it and send it to less:
# fls -rd /dev/sda1 | grep -v "(realloc)" | less
In the third column you will see the numbers of the inode files, and in the fourth - their names.
To extract a file from the FS, use the icat command (the "-r" flag is intended
to recover a deleted file):
# icat -r /dev/sda1 1023 > /home/vasya/tmp/my_file
To restore all files, you can use the following command:
# for i in `fls -rd /dev/sda1 | grep -v "(realloc)" |\
awk("print $3")|tr -d [:]`; do icat -r -f fat /dev/sdb1 $i >\
/home/vasya/tmp/inode-$i ;done
If you want to find a specific file, then the output of fls can simply be “grown”:
# fls -rd /dev/sda1 | grep -v "(realloc)" | grep my_file.jpg
The great thing about the Sleuth Kit utilities is that they use
many different methods for searching for deleted files and their parts. This and
analysis of file system control structures, and various heuristic methods,
and pattern matching. In fact, with the help of the Sleuth Kit it is possible to return to
life, even files overwritten on ext3 (despite the fact that the ext3 developers themselves talk about
impossibility of carrying out such an operation).
Repairing file systems
Fixing a broken file system is very simple. Enough
use standard utilities fsck.vfat (for FAT12 file systems,
FAT16 and FAT32), fsck.ufs (for UFS, UFS2, FFS) and ntfsfix (for NTFS).
Unfortunately, ntfsfix is not able to completely cure NTFS. She only corrects
some of its problems and sets the forced file check flag
system, so the next reboot in Windows will start
chkdsk for a complete check of the FS.
By using a virtual machine we can avoid the need to reboot into
Windows. For this:
- Start the virtual machine and install Windows on the virtual machine
HDD. - Let's unmount the partition containing the NTFS file system.
- We launch a virtual machine with the first hard drive
we indicate the virtual disk with Windows, and the second one is our real hard disk
disk. - Using standard Windows tools, we launch a scan of the NTFS partition.
Copying partitions
Let's say you bought a new hard drive and want to transfer several partitions
from the old disk to the new one. If you start doing it using standard methods,
through creating a new partition and manually copying files, you risk getting screwed
a lot of problems associated with file name encodings, special files,
protected files, and you will lose a lot of time. It's better to use the method
cloning a partition.
UNIX users clone partitions using the standard dd utility, which
can be used in conjunction with any file system. To do this on a new disk
a partition is created identical in size to the source, and the command "dd if=partition1" is executed
of=partition2 bs=1m". In the same way you can copy an NTFS partition, but in a package
ntfsprogs is a more suitable utility for this purpose.
The ntfsclone program is identical in functionality to the dd command except
two features. Firstly, it does not copy unallocated areas of the file
system, and the move is faster, and the partition image (if you create
image) takes up less space. Secondly, ntfsclone is capable of storing an image in
a special compressed file that is convenient to transfer to other machines.
To clone a partition, just run the following command:
# ntfsclone --overwrite /dev/hda1 /dev/hdb1
And to create an image:
# ntfsclone --save-image --output backup.img /dev/hda1
The ntfsclone utility is especially convenient if you decide to copy the installed
Windows for a whole fleet of other machines (classroom or office). For this
it is enough to install Windows on one machine and create an image, which then
You can put it in a ball and use Linux LiveCD to upload it to other machines. To
they were able to boot, you will also have to copy the MBR record of the disk:
# sfdisk -d /dev/sda > /share/sda-sfdisk.dump
# dd if=/dev/sda bs=512 count=1 of=/share/sda-mbr.dump
And then write it to the disk of all machines:
# sfdisk /dev/sda< /share/sda-sfdisk.dump
# dd if=/share/sda-mbr.dump of=/dev/sda
Data transfer
What to do if you decide to completely switch to Linux, but don’t want to
use various tricks and ntfs-3g to access your old data,
located on an NTFS partition? After all, this section can take up most of the
disk, and there is no way to simply copy its contents to a new one
partition formatted in ext3/ext4. In this case, they will come to your aid again
utilities from the ntfsprogs package, or rather one of them is ntfsresize, which will allow
copy data in small portions to a new file system and then
decreasing the size of the NTFS partition and increasing the ext3/ext4 partition. For this you
you will need some LiveCD containing ntfsprogs and e2fsprogs versions no lower
1.41 (for ext4 support, if, of course, you are going to transfer data to
her). It is also very desirable that the LiveCD contains the latest gparted, because
that changing the size manually is difficult and dangerous (except for changing the size of the file system itself,
you have to resize the partition using fdisk, one error and the whole operation
you'll have to start over).
So, boot from the LiveCD and mount the hard drive partitions. Let's say it
the size is 120 GB. Of these, 80 GB is a packed NTFS partition, and
the remaining 30 GB (yes, exactly 30, after converting marketing gigabytes into
the actual disk volume turns out to be approximately 111 GB) - this is a partition with
installed Linux, which occupies 5 GB. So our "window"
equals approximately 25 GB. We move files from the NTFS partition to the ext3/ext4 partition until
until their total size becomes equal to the size of the window. As a result
the latter turns out to be completely full, and the first “loses weight” by 25 GB.
Unmount both partitions and run gparted. Select the NTFS partition, press second
mouse button, select Resize/Move and reduce the section by the size of the window, select
ext3/ext4 partition and increase it by the same window size (the partition will have to
move to the beginning of the disk, and then enlarge). So we get another 25 GB
free space, which will allow us to copy some of the files, and then again
resize. Four such passes, and we completely delete the NTFS partition, and
The ext3/ext4 partition is expanded to cover the entire disk.
conclusions
As you can see, Linux can not only work with many third-party
file systems, but is also equipped with a lot of utilities for modifying them, carrying out
diagnostics and other operations. You will never find yourself in a hopeless situation
situations, keeping on hand a Linux-based LiveCD, which is exactly what
The most Holy Grail of any system administrator and user.
WWW
Foremost, another popular software for
restoring files using templates.
www.sysresccd.org -
The System Rescue CD contains all the programs mentioned in the article.
An operation such as recovering deleted files in Linux is rarely required. But in order not to be left without important data at the wrong moment, you should be prepared in advance and be able to quickly take the necessary measures.
Recovering deleted Linux files
There are 2 options for recovering data in a Linux system - directly from the system’s hard drive and from a flash drive.
Linux Hard Drive Data Recovery
File systems used in all operating systems, not just Unix-like ones, are organized in such a way that they do not allow a deleted file to disappear without a trace. That is, if a file was created and located on the hard drive, it means that it occupied some space and was included in the list of links among other objects.
When the user deletes it, the link to the file is deactivated, signaling to the file system that the occupied space can be marked as permanent. In fact, the deleted object still exists and is located on the clusters on which it was. Its complete erasure will occur only after its trace is overwritten with other data.
From which it follows that as long as the space where the file was located is untouched, it can be restored. Accordingly, after detecting data loss, you need to immediately stop all recording processes (downloading files, creating documents, updating the system and programs, installing software) and start restoring it.
Recovering data from a Linux flash drive
Since the Recycle Bin works slightly differently in Linux than in Windows, the first thing you should do is test it. Files deleted using the usual method, without emptying the recycle bin afterwards, are stored there. To restore, just connect the drive, go to the trash and restore the object.
But if the data is erased from both sources, you will have to resort to built-in or third-party recovery software. Before doing this, it is recommended to make a backup copy of the partition on which the file was located. To do this, you must follow the instructions below, with the caveat that to create a copy you need an amount of free hard disk space equal to the capacity of the flash drive. If attempts to restore data on the drive itself fail, you can contact a more experienced technician, providing him with a virtual copy of the partition.
File recovery programs for Linux
The simplest and most obvious way out is to go to a specialized data recovery service. But there is a huge disadvantage - the price. The extraction procedure is very expensive, and no one will tell how difficult this process was. There is also no guarantee for the return of all objects, especially since equipment that can restore a file after several overwrites is supplied only to special services. So, before you despair, you should try to carry out the operation on your own.
Recovering Linux Files with GParted
The most common program for working with partitions in Linux. However, not all distributions come with it. Not the most reliable assistant in such operations, but it’s worth trying as an option.
Recovering files with Scalpel
Scalpel Linux is a small tool that specializes in recovering deleted files from EXT4 partitions and other file systems. It has in its arsenal a database of file system types and data formats, which makes it universal. After all, during scanning, it compares the remaining records on the hard drive or flash drive with its own list, and if a match is found, it begins to recover deleted Linux files.
Installation and use are simple:
The process can be seen more clearly here:
Recovering Ubuntu Data with TestDisk
TestDisk can also help you recover files from Linux, but in a slightly different way. The fact is that this software is not aimed at extracting data from drives, but at testing and restoring the functionality of the partitions created on them.
There is also a program in Ubuntu - PhotoRec. First of all, its functionality is designed for restoring multimedia files and archives. This software completely ignores errors, missing or formatted file systems, thereby scanning data without any problems.
Now it comes bundled with TestDisk, and because of this combination of efforts, the resulting utility is considered the best among Ubuntu file recovery programs. To avoid problems due to user inexperience, during basic settings and manipulations, the utility uses the “everything in the system is read-only” approach.
By identifying information errors, TestDisk can recreate lost partitions in various file systems, such as FAT, NTFS and EXT4. Even if the partition was previously deleted, by finding traces of it, the program will be able to fix dependencies that prevent the file from being accessed correctly. The program is available in the official Canonical repository. In order to start recovering data from an Ubuntu hard drive, you need to follow the instructions:
Linux data recovery with Safecopy
Safecopy is a simple tool for interacting with partitions and data. It does not help in recovering data from an Ubuntu flash drive, but it will be able to copy objects from damaged media to healthy ones. Its advantage is that it completely ignores errors that occur when reading and copying files. What can best affect your attempt to save multimedia files.
A couple of broken bytes can do little harm to a photograph or video, and a text document will most likely just need to be corrected a little. But working with archives, especially if they are password-protected, can be disrupted.
To work with the program you need:
How to delete a file on Ubuntu
There are many ways to delete a file in Ubuntu. But it also all depends on whether it is a system file or a user one. This is easy to understand. Everything that is located before the /home directory is system files, while everything inside it is user files.
Recovering deleted data is possible as long as you do not overwrite other information in its place. This is true for any media, so in Mint and other builds of Linux or Windows, the return of erased files is carried out according to the same scheme, only the tools differ. Below you will find instructions for working with some programs that are excellent at recovering deleted data on Linux.
Recovery via Photorec
The utility, as the name suggests, was created specifically for searching for deleted photos. However, over time, the application has turned into a powerful program that finds and returns files of various formats from oblivion. The only condition for successful recovery of deleted data is that nothing should be written in its place. Therefore, immediately after files disappear, you must stop working with the disk from which they were deleted. Copying new files, changing the password - you don’t need to do any of this.
The Photorec program is distributed free of charge as part of the TestDisk package and does not require a registration key. To install it on Linux Mint or another version, open a terminal and run the command “sudo apt-get install testdisk”. To run the program, use the "sudo photorec" command.
- After starting the application to recover files deleted from the system, enter the user password set on Linux Mint. By entering the password, you will see all the connected drives that are identified in the system. If there is no password, then you do not need to enter anything; the connected media will be displayed immediately. Using the arrow keys on your keyboard, select the partition where the erased data was stored and press Enter.
- In the next window, you can immediately start a search or slightly customize the criteria by filtering out files that do not need to be restored. If you immediately start searching for data deleted from your system, you will spend a long time sorting through file “garbage.” Photorec can find something that the user has long forgotten about, so it is better to limit the program a little. Highlight File Opt (use the right arrow to move) and press Enter.
- By default, all file types are selected. But in order not to overload the system with unnecessary work, uncheck all the marks by pressing the “S” key. Then use the arrows to highlight the data formats that need to be restored and press the space bar to check the box.
- Then return to the previous window. Select the FAT32 format and start the search with the “Search” button.
- Leave the selection on “Other”.
- Select data search mode. If you select "Free", Photorec will only search for deleted files in empty space. If you select the “Whole” mode, the program will scan the entire surface, which will make it possible to recover files that were deleted from the system so long ago that the user forgot about them.
- The last step is to select the directory in which the data found by the program will be saved. To start scanning, press the “C” key in the English layout.
The main rule of recovery is to never save files to the partition from which they were deleted. It's better to use removable media; when the recovery is complete, simply transfer the data back to the system. All the data that Photorec can find and recover will be located in the folder that you specified in the last step. The file names will change, so you will have to spend some time parsing the data, but this is not as critical as losing important information.
Sometimes it happens that we accidentally delete files that we still need. This is especially dangerous in the Linux terminal, since here files are not deleted into the trash, but are erased from the disk immediately and forever.
It is clear that you need to carefully handle file deletion commands, but what to do if everything has already been deleted, but the files were important and need to be restored urgently? In some cases this is possible. In our today's article we will look at recovering deleted Linux files.
Each file takes up a certain space on the hard drive, but the file system, to provide access to the file, gives us links to its beginning, through which any program can obtain the contents of the entire file. It would be ineffective if deleting a file resulted in a complete overwriting of its area on the disk.
Instead, the file system simply removes the reference to that area from its base and then marks the space where the file was located as immutable. But in fact, all your files are still there. From this we conclude that if, after deletion, the file system is very quickly switched to read-only mode, then all deleted files can be restored.
If you worked with this file system and the data on the disk was overwritten by others, then you will not be able to save anything yourself. You may have heard that intelligence agencies can recover data that has been overwritten several times using the residual magnetic trace on the disk. This is true. But to solve such a problem, you need special equipment; a few programs are not enough; you need a special laser that can read the magnetic trace along the edges of the track and other equipment. So you can forget about this method for yourself.
Well, we will focus on software recovery, when the data has been formally deleted, but is physically still on the disk intact and safe. Next, we’ll look at several utilities that will help you recover deleted Linux files.
1.Safecopy
Safecopy is a fairly simple data recovery tool that simply copies data from one location to another. The utility, as such, does not restore individual files. It simply allows you to copy data from a damaged device to a normal one.
The difference between this utility and other copy programs is that Safecopy does not exit when it encounters any errors, be it a bad read operation or a bad sector. It has many additional options for customization, as well as the ability to create a file system image from damaged media. Data is recovered carefully and quickly as possible.
The utility can be installed from the official repositories of your distribution. Ubuntu users can use this command:
sudo apt install safecopy
Here you will not recover deleted files, but you can copy damaged data. For example, for video, a few damages do not matter much. To start file recovery in Linux from the /dev/sda1 partition, run:
sudo safecopy /dev/sda1 /home/files/
All files that can be copied will be in /home/files/.
TestDisk is a very powerful data recovery tool. It doesn't try to copy data from a damaged device, but rather helps you fix errors and partition-level issues that may be preventing you from working with your data.
The utility can recover lost partitions, fix GPT and MBR partition tables, make disk backups, restore boot records, and most importantly, recover deleted files from NTFS, FAT, exFAT and Ext family file systems. You can also copy files even from remote partitions for the same file systems.
The way the utility works varies greatly depending on the desired action. Here you will find a pseudographic wizard who will guide you through all the steps. You can also install testdisk from the official repositories. On Ubuntu, use the command for this:
sudo apt install testdisk
Since the topic of our article is restoring Linux files, let’s look at how this is done using this utility. Run the program:
At the first step of the wizard, select Create New Log:
Select the partition table on the disk:
To work with the file system, select Advanced:
Next, select the section, then the list command:
Here you will see all the files that are on this section. Deleted but recoverable files will be marked in red.
It is more convenient to work with this utility than with Photorec, because here you can select only one file you need, and not restore a bunch of garbage at once. To copy a file simply select it, press c and choose a folder to save. True, you understand that for recovery it is necessary that the files are not overwritten, somewhere a little overwritten and that’s it.
Our latest program is focused primarily on searching and recovering deleted videos, photos, documents and archives. We can say that this is a program to recover deleted Linux files. The advantage of PhotoRec is that it completely ignores the file system and looks at the raw data, which means it will still work even if the file system is corrupted or reformatted, but only in fast mode, where only the headers are erased.
To avoid any problems, read-only access is used here, which is quite sufficient for data recovery. But as I said before, you need to stop all write operations as soon as you realize that you need to recover the file. Otherwise, the necessary data may be overwritten by something new and you will no longer be able to restore it.
The utility has several settings. You can specify file extensions to find, size, modification date, and so on. You can install the program in the same way as TestDisk - from the official repositories.
For example, on Ubuntu run:
sudo apt install photorec
As for use, there is an interactive interface similar to testdisk. Run the utility with the command:
Select the disk you want to work with:
Choose a section:
Select a file system: The program will recover many files, and most likely more than you need. Moreover, its main problem is that the file names are not saved and you will have to search further to find if what you need is there.
conclusions
These three tools cover a wide range of Linux file recovery tasks. Here you can not only recover deleted linux ext4 files, but also fix your hard drive or copy files from damaged media.
What are your favorite data recovery utilities? Which ones do you use? Write in the comments!
For dessert, a video from Discovery about how a hard drive works: