How To Recover Deleted Files In Linux [Beginner’s Guide]

Brief: This article shows you how to recover deleted files in Linux using command line tool Test Disk. It’s an easy to use tool that almost anyone can use to recover lost files in Ubuntu or other Linux distributions.

Have you ever gotten that horrible feeling? The one you get when you realize that you accidentally deleted files and it’s not even in the trash? Often it is immediately preceded by denial: I know I have another copy of it somewhere.

But rather than going through all the stages of grief, don’t worry. And remember you’re not alone; sooner or later everyone does this.

“Don’t worry?” you counter, “I just erased the only copy of my resume!”

No really, don’t worry. All that’s happened is that it’s been bumped off a list. So long as you don’t write onto the drive, it absolutely still exists. In fact, depending on the size of the file and the free space on your drive deleted files can persist indefinitely—even if you do write on the drive.

“Yes, fine” you say, “I’ll rest easy knowing my resume ‘exists’ in some abstract sense. But so far as I’m concerned if I can’t open, edit or print from it, it doesn’t exist in any practical sense. What would really help would be a way to ‘un-delete’ files. And one that doesn’t require an IT forensics lab.”

Really, don’t worry—you don’t need a lab to recover the deleted files. Furthermore, if you can get past using a primitive GUI, it’s actually easy to do! I’ll show you how to use TestDisk to recover deleted files.

How to recover deleted files in Linux using TestDisk

How to recover deleted files in Linux

Let me present a simplified example: I took a clean thumb drive added some files, then deleted one. Now, my system has a feature which will directly delete files from removable media, by-passing the “trash” altogether; that is if I choose to “right” click on a file and then choose “delete”. It still presents a warning, but one click on the “yes” button and the file is gone forever. Or appears to be.

But this time I didn’t get that horrible feeling. And no, not because this is a cooked up scenario. I knew that all I had to do was open the terminal type “testdisk” and hit “enter”. When I did this for the first time I had one of my “Linux moments”. Because if you don’t have it—and I didn’t—it tells you how to get it! Just type “sudo apt install testdisk” and enter and you’ll have it in about 10 seconds.

Step 1

You need to install TestDisk tool first. Most Linux distributions already have this tool in their official repository. In Ubuntu and other Ubuntu based Linux distributions such as Linux Mint, elementary OS etc, you can use the command below to install TestDisk:

Suggested read
Beginner's Guide To Install Linux On Chromebook

sudo apt install testdisk

Arch Linux users can install it from AUR. You can download it for other Linux distributions from the link below:

Download TestDisk

Though I am using Ubuntu in this tutorial, this doesn’t mean it is only to recover deleted files in Ubuntu Linux. The instructions presented here works for other distributions as well.

Step 2

Run TestDisk in the terminal using the command below:

testdisk

Step 3

When you open it, you’ll see something that looks like this. Be patient! The interface is actually straightforward but you do have to carefully read the text. Use the arrow keys to navigate and “enter” to select.

How to recover deleted files in Linux using TestDisk
Select ‘Create a new log file’

Screens that have extra commands will tell you so. Also note that TestDisk 7.0 tends to highlight the next reasonable step. It’s almost always right but do read the screen, since it can’t read your mind. In any case, when it wants you to let it create a log file, indulge it. It’s about to pull you out of a hole.

Step 4

Now, at this point, if you’re lucky, you should see your drive. And you can proceed to the last steps. But let’s assume you’re not, that you have, say, a multi-boot machine. In this case, ownerships can get blurry, and Testdisk needs your permission to open them. You’ll see something like this:

How to recover deleted files in Linux using TestDisk
Sometimes you may need sudo rights

Select “sudo” and enter your password. Hit “enter” and “enter” again on the next screen to create another log file.

Step 5

This time Testdisk displays all your drives. Arrow key to the drive in question and hit enter.

How to recover deleted files in Linux using TestDisk
You’ll have to select the drive where you are looking for files

Step 6

Testdisk has again selected the correct setting. This makes sense since a simple storage device is seldom partitioned. Again hit enter:

How to recover deleted files in Linux using TestDisk

Step 7

And finally we have to do a little thinking to do. If you read the first screen—and I’ll bet you didn’t—this program isn’t just for recovering deleted files. It’s a powerful disk utility. But if we remember what we’re trying to do the choice is fairly obvious: we’re not trying to fix a disk, we’re trying to recover a file. Select “Advanced” and hit “enter”.

How to recover deleted files in Linux using TestDisk
Select Advanced

Step 8

At the bottom of the page choose “Undelete” and get ready to see a ghost!

How to recover deleted files in Linux using TestDisk
Select Undelete

Step 9

Testdisk will scan for files and produce a list of deleted files highlighted in red. Arrow down to it and carefully read the choices at the bottom.

How to recover deleted files in Linux using TestDisk

Step 10

Again, bear in mind that Testdisk is a multi-function tool. Most of these options deal with groups of files; we only want our damn resume back! So hit “c”.

How to recover deleted files in Linux using TestDisk
Hit C to copy and thus recover the deleted file

As you can see from the scoreboard, we’ve won 1-0. After hitting “c” there are options about where you might want to recover the file to, but it defaults to your home folder. And again this is generally the best thing to do. Navigating in Testdisk is a little tricky, whereas dragging and dropping after the fact is a breeze.

Suggested read
Celebrate Christmas In Linux Way With These Wallpapers

A few tips on recovering deleted files in Linux using TestDisk

First, if you find yourself somewhere you don’t want to be, hit “q” for quit. This won’t close the program, instead, it will act like the “back” button on a program with a full blown GUI, and put you back a page. And just like a “back” button repeating will eventually lead you back to the beginning.

Second, as with anything, the fewer the distractions, the easier it is to find what you’re looking for. In other words, physically detach all other storage drives. In graphically simple environments simplicity is your friend.

Finally, Testdisk can also help you retrieve files that have become inaccessible for other reasons. In fact, this is why I started using the program in the first place. I was trying to save files from a corrupted drive that could not be made to boot. Normally it’s simply a matter of removing said drive any hooking it up to a USB adapter. You can then mount it on another PC and copy the files where ever you want.

But what if the drive is formatted to LVM? This was my problem because a mounted LVM drive looks nothing like a normal Linux OS. None of the usual files appear, and hunting around simply doesn’t help. This, among other reasons, is because most Linux file managers can no longer read ext.2 file systems.

Nevertheless, after a few false starts, I was able to find and save the missing files. Note, however, that the sequence of steps here will be a little different, you may need to use the “analyze” option for Testdisk to make sense of the drive and you may have to poke around a little to find the “home” folder once you do. Furthermore, the files you’re looking for will not appear in red since they were never deleted in the first place. But once you do find them, the copying procedure is basically the same.

With Testdisk and a little luck, you may never lose your resume again as you can always recover deleted files in Linux.

Disclaimer: This tutorial is a reader submission.

About author Dave Merritt: I’m a 59 years old, full­time landscaper and part­time PCmedic. I’ve been an avid Linux user for over ten years. In that time, I do not claim to have made every possible mistake, only most of them. I’m a big fan of prog rock, avant­ jazz and J S Bach, and enjoy reading Neal Stevenson and anything to do with the foundational problems in modern physics.

Comments

  1. Just tried your excellent tutorial. Sad to say that it doesn’t work in Mint 18 :-( I know TestDisc but have not used it for this purpose but needed to today. I can get to the directory where my deleted file should be but the one I deleted is not there, in red or any other colour.

  2. I had the same problem two years ago and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The syntax is very easy:

    ext3grep image.img –restore-all

    or:

    ext3grep /dev/sda3 –restore-all –after date -d ‘2015-01-01 00:00:00’ ‘+%s’ –before `date -d ‘2015-01-02 00:00:00’ ‘+%s’

    This video (https://youtu.be/XZTXcGVFgiE) is a mini tutorial that can help you.

  3. I guess I’ve just had one more of those “Linux Moments” as both of my Linux partitions don’t have the “undelete” options. The irony goes as far as I deleted some files on my pendrive because Linux screwed it up with rights management and had to erase, format many times until I’ve done it with Windows. I guess I’ll let the data in the nether forever now and have a earned rest.

  4. Thank you! After an hour of searching this is the only tutorial which showed how to do such a simple function as undelete a file in Linux. There are still some things that work better in Windows and this is one of them. How they can allow basic deficiencies such as this is baffling.

  5. THAN YOU, THANK YOU, THANK YOU! I deleted my C:\driver with Windows, etc. on it (I dual boot, using Linux 90% of the time), making some too quick moves in G-Parted. Your instructions got everything back 100% intact. I was blown away. Due to my configuration, I had to change a couple of the instructions, but easy enough! Thanks again!

  6. Three cheers for Abhishek! Got home from a wonderful trip today, popped open a beer, then went to check out my new photos and videos. Well, something went wrong (not sure what, but it was surely my fault), and *poof*, empty card. I tried far too many complicated solutions before finding this page; testdisk is very simple to use, and you did an excellent write-up. Thanks for holding my hand and walking me through this not-scary-anymore endeavor. I’m so happy that I have to comment!

    Hmmm, now how can I repay the favor? Maybe, since English is my first (and only) language, I can help with your “About”. First, you want to reword the opening sentence to something like “I am a professional software developer, and creator of It’s F.O.S.S..” No need to repeat your name, or to quote ‘creator’, and the sentence structure is a bit off. Next, change “mystery” to its plural “mysteries”. Last, make a proper possessive for Agatha Christie “I’m also a huge fan of Agatha Christie’s work.” That apostrophe before the S shows that it’s her work you’re a fan of (not always the rule, but it usually is). English is a silly language, no way I could figure it out without being born into it, I’m amazed anyone can learn it. Hope this isn’t offensive, the article is quite good, I just noticed your “About” as I typed this up and thought maybe I could help you with something, since you’ve really helped me out here.

    Thank you, Abhishek! Keep up the great work!

  7. i have no undelete option. the partition is ext4 and botable (the system partition). i also have a ntfs partition on the same ssd and if selected in testdisk shows the undelete option but not the ext4 one. i also booted from a live ubuntu usb stick with same results..
    i’m trying to undelete a file that had no extension (text file created in gedit) and photorec doesn’t find it.

    any ideas?

      • “Undelete files from FAT, exFAT, NTFS and ext2 filesystem” – from the test disk description. I guess it doesn’t work on ext4.

        • Hi Lu. I’ve used this tool to recover inaccessible/deleted files from ext4 many times in the past. However, every time it was with an Ubuntu based system. It is possible that it won’t work some on Linux/Unix variants.

          It is also possible that that Testdisk will work, but only if the drive is inactive. (Active built-in security widgets may prevent such probing.) And to tell you the truth, I’ve never used it to probe an active disk. (As a general rule it’s much easier to manipulate a drive when it’s inert.)

          So, as I see it you have 2 options, which I’ll list in order of likely success:
          1- Remove your SSD. Hook it up to a disk enclosure/USB adapter. (Turning an internal drive into an external is an invaluable trick. Adapter/enclosures are usually cheap, especially for SSD’s since they don’t need an extra power coupling to spin a disk.) Then mount the drive on a second Linux machine. (If you have to borrow someone else’s make sure they’re around since you may need them type in THEIR password.) If the active system WAS preventing it from working, it can’t now. If Testdisk isn’t installed, do so. This method has never failed me.

          2-Try it from your Windows partition. I can’t vouch for anything Windows, but i know Windows compatible software exists though It’ll likely cost you.

          Bear in mind: It could be that your file has already been overwritten. Home folders are busy places: every time you open an email, browse the web, create a file etc. you are making changes. And every time you make changes there’s a chance the sector a deleted file is stored could get altered. In other words, Testdisk may not be showing the “undelete” option because there are no intact undeleted files on your drive.

          Also, all the gedits I’ve created and saved generally end in “.txt”. It could be the lack of an extension is the problem.

          Finally, Testdisk can probe encrypted home folders but you’ll need to have use the “Decryption” options first.

          Please let me know if any of this helps.

          • thanks for responding.
            i did run testdisk from windows but with the same results – no undelete option when the ext4 partition is selected.
            i also booted into a live ubuntu sesion on my phone using drivedroid (on android) with same results – testdisk sees the partitions but has no undelete option on the ext4 one.
            i dont hace a sata to usb adapter so i can’t test that method.
            i also salvaged all files with photorec and then tried to find the one i need (since the saved files are randomly renamed) searching for words that were inside the file using grep but with no luck. so my deduction was (since photorec searches for file types by extension i presume) that it did not find the one i needed since it did not have any extension.

            thanks again for your reply, maybe this discussion will help someone else facing the same problem.

Leave a Reply

Your email address will not be published. Required fields are marked *

[i]
[i]