Recover Deleted Files Using Linux [Beginner's Guide]

Learn to attempt data recovery on external disks and SD cards using TestDisk and PhotoRec tools in Linux.
Warp Terminal

Be extra careful when you delete things. Recovery is not always easy.

There are a few open source tools that an end user can use to attempt data recovery.

Attempt? Yes because there is no guarantee that data can be recovered fully and completely.

In this tutorial, you'll learn to use two popular open source data recovery tools:

  • TestDisk: Can restore lost partitions, recover boot sector and undelete files
  • PhotoRec: Primarily for recovering photos, videos and documents (not dealing with entire partitions)
🚧
Both tools work on external disks (HDD, SSD, USB) and SD cards. You cannot use them to undelete files on the very system where the disk is in use. They are more suitable for recovering files from external disks.

Recover deleted files from an external drive in Linux using TestDisk

Let me present a simplified example: I took a clean thumb drive added some files, and then deleted one. Now, my system has a feature that will directly delete files from removable media, by-passing the “trash” altogether; that is, if I choose to “right” click on a file and then choose “delete”. It still presents a warning, but one click on the “yes” button and the file is gone forever. Or appears to be.

But this time I didn’t get that horrible feeling. And no, not because this is a cooked-up scenario. I knew that all I had to do was open the terminal, type testdisk and hit “enter”. When I did this for the first time, I had one of my “Linux moments”. Because if you don’t have it—and I didn’t—it tells you how to get it!

If you prefer videos, you can watch this video of the same tutorial on It’s FOSS YouTube channel:

Recover Deleted Files from External storage devices in Linux.

Step 1

You need to install the TestDisk tool first. Most Linux distributions already have this tool in their official repository. In Ubuntu and other Ubuntu-based Linux distributions such as Linux Mint, elementary OS etc., you can use the command below to install TestDisk:

sudo apt install testdisk

In Arch Linux, it is available in the official Extra repository. You can download it for other Linux distributions from the link below:

🚧
Remember, the Undelete feature is visible only to the external drive. For the native Ubuntu/Linux file system, this option was absent, which means, unable to recover files from the native OS filesystem.

Step 2

Run TestDisk in the terminal using the command below:

testdisk

It needs a minimum 24-line terminal height to display things properly.

TestDisk needs a minimum 24-line terminal to work properly.
TestDisk needs a minimum 24-line terminal to work properly. 

Step 3

When you open it, you’ll see something that looks like this. Be patient! The interface is actually straightforward, but you do have to carefully read the text. Use the arrow keys to navigate and “enter” to select.

Create a new log file.
Create a new log file.

Screens that have extra commands will tell you so. Also, note that TestDisk 7.0 tends to highlight the next reasonable step. It’s almost always right, but do read the screen, since it can’t read your mind. In any case, when it wants you to let it create a log file, indulge it. It’s about to pull you out of a hole.

Now, if you are running TestDisk in a new terminal, that does not have sudo permission, it will ask you to enter the password.

Enter the sudo password for TestDisk to work.
Enter the sudo password for TestDisk to work. 

Step 4

This time, Testdisk displays all your drives. Use the up/down arrow key to highlight the drive in question, highlight the Proceed option, and hit enter.

You’ll have to select the drive where you are looking for files
Select the Drive from where you want to recover files.

Step 5

Testdisk has again selected the correct setting regarding the partition. Again hit enter:

TestDisk automatically identifies the disk partition of the selected drive
Select Disk Partition in TestDisk
🚧
Unless you have a specific reason, do not select the "None" option. In most cases, TestDisk automatically identifies the partition.

Step 6

And finally, we have a little thinking to do. If you read the first screen—and I’ll bet you didn’t — this program isn’t just for recovering deleted files. It’s a powerful disk utility. But if we remember what we’re trying to do, the choice is fairly obvious: we’re not trying to fix a disk; we’re trying to recover a file. Select “Advanced” and hit “enter”.

Select the "Advanced" option
Select the "Advanced" option.

Step 7

At the bottom of the page, choose “Undelete” and get ready to see a ghost!

Use the Undelete option to list the deleted files in a drive
Undelete option in TestDisk

Step 8

Testdisk will scan for files and produce a list of deleted files highlighted in red. Arrow down to it and carefully read the choices at the bottom.

When you select the undelete option, files that are deleted from the drive are listed in a red font color.
Deleted files are highlighted in red font color

Step 9

Again, bear in mind that Testdisk is a multi-function tool. Most of these options deal with groups of files; we only want our damn resume back! So, highlight the file we want to restore (Here, the Resume.doc, as shown in the above screenshot) and then hit “c”.

Now, select a destination for the file.

Select a destination to store the recovered files.
Select a destination to store the recovered files.

Once you reach the destination you want, press C to confirm. It will copy that file to the location.

You will be notified the copying is a success or failure.
Success message showing copy complete.

You can now select other deleted files like this and press C to copy. It won't ask for location in the ongoing session.

💡
You may need the root password to unlock the files recovered.

Take a look at the complete process with this SVG:

Using TestDisk to recover deleted files from external drives. in the final part, to copy the deleted files, use "c" after highlighting them and to confirm the directory to restore files, use "C".

A few tips on recovering deleted files in Linux using TestDisk

First, if you find yourself somewhere you don’t want to be, hit “q” for quit. This won’t close the program, instead, it will act like the “back” button on a program with a full-blown GUI, and put you back a page. And just like a “back” button, repeating will eventually lead you back to the beginning.

Second, as with anything, the fewer distractions, the easier it is to find what you’re looking for. In other words, physically detach all other storage drives. In graphically simple environments simplicity is your friend.

Finally, Testdisk can also help you retrieve files that have become inaccessible for other reasons. In fact, this is why I started using the program in the first place. I was trying to save files from a corrupted drive that could not be made to boot. Normally it’s simply a matter of removing the said drive and hooking it up to a USB adapter. You can then mount it on another PC and copy the files where ever you want.

But what if the drive is formatted to LVM? This was my problem because a mounted LVM drive looks nothing like a normal Linux OS. None of the usual files appears, and hunting around simply doesn’t help. This, among other reasons, is because most Linux file managers can no longer read ext.2 file systems.

Nevertheless, after a few false starts, I was able to find and save the missing files. Note, however, that the sequence of steps here will be a little different, you may need to use the “analyze” option for Testdisk to make sense of the drive, and you may have to poke around a little to find the “home” folder once you do. Furthermore, the files you’re looking for will not appear in red, since they were never deleted in the first place. But once you do find them, the copying procedure is basically the same.

How to recover deleted files in Linux using Photorec

PhotoRec is a companion program to TestDisk, and is designed to recover lost files including video, documents, and archives from hard disks, CD-ROMs, and lost pictures.

Photorec ignores the file system and only looks for the data. This helps the user to recover data, even if the file system has been severely damaged or reformatted.

If you install TestDisk, this package is also installed. So, to run PhotoRec, use:

photorec

Now, this also requires the sudo password. Once given, it will list all the file systems available on the device. Select the required one and hit proceed.

Select Proceed after selecting the required file system
Select Proceed after selecting the required file system.

On the next screen, use the Up/down arrow to select the required section of your disk and then use the Right/left arrow key to highlight the File Opt and hit enter.

Select File Opt to set the file types that need to be recovered
Select File Opt to set the file types

Here, you will get a list of supported file extensions. By default, all options are selected (x mark). You can press s to unselect all. Now, scroll through the list using the Up/down arrow key. You can select individual file types by pressing the Space key during highlighting a particular option.

Select File Types like PNG, PDF etc. that need to be recovered. use space key to select or unselect individual items
Select File Types for recovery.

Here, you can see that I have unselected all and selected only PNG and PDF. Now press enter to quit this screen.

You can now highlight the Search tab and press enter.

Select Search tab and hit enter
Select Search and hit enter.

On the next screen, you need to select the partition type of your file system. It is self-explanatory. Unless it is an ext2/ext3/ext4 filesystem, choose Other.

Select Partition type.
Select Partition type.

On the next screen, you should select the destination for the recovered items. Better to keep this in an external medium.

🚧
Please try to use some external medium as the recovery destination. Because sometimes, the recovery will be huge in size and may run out of your source file system storage capacity.
Select the destination directory.
Select the destination directory.

You can find your external drives in the /media/USERNAME/ directory.

Now, press C to confirm the directory. In the case of my native file system, the recovery process started at this point.

In the case of a thumb drive, where I had a FAT32 file system, I select the “Other” option in the partition type selection. This will bring another screen, where you have to select whether you want to recover data from the whole drive or from unallocated space only.

Select either recovery from free space or extract the file from the whole drive.
Select either recovery from free space or extract the file from the whole drive.

You can select according to your need and press enter after highlighting the particular option.

Now you can select the destination, and it will start the recovery.

You may need to wait for some time. It may take several hours. Once completed, it will prompt the details of the recovery.

PhotoRec wll prompt a Recovery Complete message once finished
Recovery Complete

You can get the recovered files from the destination that you choose earlier.

Recovered files in Nautilus File Manager
Recovered files in Nautilus File Manager

Recovered files will be in folders called recup_dir.1, recup_dir.2 etc.

This is a comprehensive tool. It recovered many images from a thumb drive that had been formatted, as you can see in the above images.

Conclusion

If you mess up a hard disk, SSD or USB/SD Card, you can use Testdisk or Photorec and attempt data recovery. Photorec is more suitable if your digital camera card gets corrupted or you accidentally delete the photos.

I haven't found a reliable tool that lets you easily undelete files from the current system in use. Let me know if you know such a tool and I'll experiment with it to recover deleted files on Linux.

About the author
Abhishek Prakash

Abhishek Prakash

Created It's FOSS 11 years ago to share my Linux adventures. Have a Master's degree in Engineering and years of IT industry experience. Huge fan of Agatha Christie detective mysteries 🕵️‍♂️

Become a Better Linux User

With the FOSS Weekly Newsletter, you learn useful Linux tips, discover applications, explore new distros and stay updated with the latest from Linux world

It's FOSS

Great! You’ve successfully signed up.

Welcome back! You've successfully signed in.

You've successfully subscribed to It's FOSS.

Success! Check your email for magic link to sign-in.

Success! Your billing info has been updated.

Your billing was not updated.