Skip to main content

How to recover deleted files on Linux

By depratama


On a typical file system, deleting a file doesn't necessarily mean that it is gone for good. When a file is removed, its meta data (e.g., file name, size, time, location of data block, etc.) is gone, but actual file data is untouched inside the file system, until the location of the data is overwritten by other file data. This means that if you accidentally deleted a file, there is a chance that you can recover the file.

In this tutorial, I describe how to recover deleted files on Linux. There are several file recovery tools on Linux. Among them is PhotoRec which is an open source file recovery software licensed with GPLV v2+. PhotoRec is available on Linux, BSD, MacOS X and Windows.

PhotoRec Features

As the name implies, PhotoRec is originally designed to restore accidentally deleted digital photos. However, now it has become versatile enough to support various file formats. PhotoRec recovers lost files by checking data blocks one by one against a signature database of different file types.

  • Supported file formats: video (avi, mov, mp3, mp4, mpg), image (jpg, gif, png), audio (mp3, ogg), document (doc(x), ppt(x), xls(x), html), archive (gz, zip) etc.
  • Supported file systems: EXT2, EXT3, EXT4, HFS+, FAT, NTFS, exFAT

Besides hard disks, PhotoRec can restore files stored on CD/DVD drives, USB sticks, memory cards (CompactFlash, Memory Stick, Secure Digital/SD, SmartMedia), etc. So if you accidentally lost digital pictures stored on the memory card of a digital camera, you can use PhotoRec to undelete them.

Install PhotoRec on Linux

The official site offers PhotoRec binaries for various platforms. So you can download static PhotoRec binary for your Linux system.

For 32-bit Linux:

$ wget http://www.cgsecurity.org/testdisk-6.14.linux26.tar.bz2
$ tar xvfvj testdisk-6.14.linux26.tar.bz2

For 64-bit Linux:

$ wget http://www.cgsecurity.org/testdisk-6.14.linux26-x86_64.tar.bz2
$ tar xvfvj testdisk-6.14.linux26-x86_64.tar.bz2

The PhotoRec executable (photorec_static) is found in the extracted directory.

Recover Deleted Photos and Videos

In this tutorial, I demonstrate how to recover deleted photos and video files stored on an SD card, which were generated by Canon EOS Rebel T3i.

When you have removed a file accidentally, what's important is to NOT save any more files on the same disk drive or memory card, so that you do not overwrite the deleted file.

As soon as you discover the lost files, run PhotoRec to restore them as follows.

$ sudo photorec_static

You will be shown a list of available media. Choose the media where you have deleted files.

Next, choose the partition which contains deleted files.

Choose the file system type used for the partition. In general, you can identify the file system type from the output of mountcommand. In case of the SD card used by Canon camera, it is formatted in VFAT file system. So choose "Other".

Choose if all disk space needs to be analyzed. In this case, choose "Free", which means scanning for unallocated space only.

Choose a destination folder where restored files will be stored. Here you must choose a different partition or drive than the one being analyzed. Press "C" when a destination is chosen.

Now PhotoRec starts reading individual sectors for lost files. You will see the progress of the recovery. Depending on the size of media, it will take a couple of minutes or even longer.

After scanning is completed, the restored files will be stored in the destination folder that you configured. Note that the size of a restored file may be either the same as or larger than the original file size.

source: xmodulo.com

Labels:

Popular posts from this blog

Extend a LVM partition after increasing its virtual disk on Virtualbox

By depratama
No Linux machine at work? the easy way could be to simply install Virtualbox in one of the PC, create a VDI and install Ubuntu 14.04 in it. But the day will come when you need more space! Here is how to resize it: Resize Virtualbox VDI Open Virtualbox, make sure to shutdown your virtual machine. Then open a terminal (here windows): 1 2 3 4 cd “ C : \ Program Files \ Oracle \ VirtualBox ” VBoxManage list vms VBoxManage clonehd uuid 0000000000000000 backup . vdi VBoxManage modifyhd uuid 0000000000000000 -- resize 204800 This is the Virtualbox official manual  of available commands. And  this is a website  to convert Gb into Mb (–resize takes Mb as input, 200Gb = 204800Mb). Boot Gparted to resize the partition After a default install of Ubuntu Server on one physical disk, you will have a SWAP partition, and then an extended partition in which you’ll have your LVM partition (So 3 partitions).  Download Gparted  .iso,...
Read more

Website Using HTTPS Protocol

By depratama
Last week, I changed protocol of my website from http to https. There were steps that i had to do. First, I installed openssl package and mod_ssl # yum install mod_ssl openssl Then, I configured the openssl  and created certificate # cd /etc/pki/tls/certs # make server.key # openssl rsa -in server.key -out server.key # make server.csr # openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650 # chmod 400 server.* After that, I changed configuration of httpd/apache #nano /etc/httpd/conf.d/ssl.conf DocumentRoot "/var/www/html" ServerName www.server.world:443 SSLCertificateFile /etc/pki/tls/certs/server.crt SSLCertificateKeyFile /etc/pki/tls/certs/server.key Last, I restarted the webserver #service httpd restart That's all what i did last week to change my website protocol from http to https.
Read more

Word 2003 “This document couldnot be registered. It will not be possible to create links from other documents to this document.”

By depratama
One day when i open a document in Ms. Word 2003, I get the message “ This document could not be registered. It will not be possible to create links from other documents to this document .” After searching using google.com and open some website, i have one solution. It’s only one maybe two step that i have to do. I open my services panel and activated my DCOM Server Process Launcher . And, it works, the message no longer show again when i open my document using word 2003. That’s all. I hope it works to you too, if you have same problem. Nb: Open services panel, just open Run (Start–> Run) and type services.msc then Enter .
Post a Comment
Read more