How to Recover Deleted Files in Linux

Sometimes you may have deleted a file accidentally and need to recover it. In most cases, if you have used rm command for deletion, then it will directly delete your file without asking for any confirmation, and also it will remove it from your location without sending it to any trash or recycle bin. In this article, we will look at how to recover such deleted files in Linux.

How to Recover Deleted Files in Linux

Here are the steps to recover deleted files in Linux. There are many third party tools available for this purpose. We will look at how to do this using couple of such tools – foremost and testdisk.

1. Using Foremost

Open terminal and run the following command to install foremost.

Redhat/CentOS/Fedora

# rpm -Uvh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el7.rf.x86_64.rpm
# yum install foremost

Ubuntu/Debian

# aptitude install foremost

Let us say you have removed the file test.jpg as shown below

$ rm /home/ubuntu/test.jpg

Please note, it is possible to recover files only if nothing else has been written on the disk sectors which it occupied previously. If you or some application has overwritten those sectors then you will not be able to recover your file.

For our example, we will assume that the deleted file’s disk sectors have not been modified.

# foremost -t jpg -i /dev/sda1 -o /home/ubuntu/rescued

In the above command /home/ubuntu/rescued is the folder location on another disk where recovered file is located. Please don’t recover files to same drive where deleted files are located. It may end up showing unpredictable behavior, or fail to recover anything.

2. Using testdisk

Testdisk is another utility that allows you to easily recover deleted files.

Open terminal and run the following command to install testdisk.

$ sudo apt install testdisk

Run testdisk using the following command.

$ sudo testdisk

You will see the following screen.

Use arrow keys to navigate between options and enter key to select one. You can hit enter at the default option highlighted by testdisk tool.

Next it will show your drive. In case it needs your permissions, it will show you options proceed, sudo, quit. Select sudo option using arrow keys and hit enter to proceed.

Next, it will display all your drives. Navigate to the drive that contained deleted file and hit enter.

Next, you will be asked to select the type of partition. In most cases, testdisk will automatically detect it and just ask you for the permission to proceed. Otherwise, select None option and hit Enter to proceed.

You will see list of tools that you need to choose from, because testdisk is not just a recovery tool but it can do a lot more. For our requirement, select Advanced and hit enter.

On the bottom of the next page, you will see a set of options against your drive. Select Undelete and hit enter.

On the next page, testdisk will scan your disk and display a list of recently deleted files that can be recovered, in red.

Navigate to the file you want to recover and hit ‘c’ key. Next, you will be asked to where you want to copy the recovered file. It defaults to your home folder.

How to Recover Deleted Files in Linux