Use PhotoRec & TestDisk tools to recover files under a Linux system

When you delete a file by intentionally or unintentionally using shift + delete a key combination, delete option, or emptying the Recycle Bin in the system, the contents of the file are not destroyed directly from the hard disk (or other storage device).

It is only removed from the directory structure of the system, and then you cannot see the file in the directory where you deleted it, but the file still exists somewhere on your disk.

If you have a suitable tool and related expertise, you can recover the lost files from your computer. However, as you store more and more files, deleted files will be overwritten and you may only be able to recover recently deleted files.

In this article, we will explain how to use TestDisk in a Linux system to recover deleted or lost files on a hard drive, which is an excellent repair tool that is released with a free tool called PHOTOREC.

The Photerec tool is used to recover lost files from storage media such as hard drives, digital cameras, and CDROM devices . (LCTT: PhotoRec means photo Recovery, not photo Recorder. ）

Installing TestDisk (PHOTOREC) in a Linux system

Perform the following related commands in the system to install TestDisk:

2. ------- On Debian/Ubuntu/Linux Mint -------
4. $ sudo apt-get install testdisk
6. ------- On CentOS/RHEL/Fedora -------
8. $ sudo yum install testdisk
10. ------- On Fedora 22+ -------
12. $ sudo dnf install testdisk
14. ------- On Arch Linux -------
16. $ pacman -S testdisk
18. ------- On Gentoo -------
20. $ emerge testdisk

If you do not have this installation package in your Linux system repository, you can download it from here and run it on the Live CD.

This installation package can also be found in the Emergency Repair CD tool, such as Gparted LiveCD, Parted Magic, Ubuntu Boot CD, Ubuntu-rescue-remix, and other tools.

After the installation is complete, open the text window with root account privileges, start PhotoRec, and specify the partition of the deleted file:

1. $ sudo photorec /dev/sda3

You will see the following interactive interface:

Linux System PhotoRec Data Recovery Tool

Use the left and right arrows to select menu options and press ENTER to confirm. To continue with the restore operation, select [Proceed] and click Enter.

You will see the following interface:

Select partition for File recovery

Select [Options] to view the available recovery options as shown in:

Linux System File Recovery options

Press Q back, in the interface, you can specify the file extension you want to query and restore. Therefore, select [File Opt] , press ENTER to confirm.

Press s to select or deselect all file extensions, if you have deselected all file extensions, just use the right arrow to select the type of file you want to recover (or press the left ARROW to deselect).

For example, I want to recover files from all the missing types in the system .mov :

Specifying the recovery file type

Press the b key to save the settings , and then you should see the information as shown. Click Enter to return (or press Q the key), and then press the Q key to return to the main interface.

Save File Recovery settings

now select [Search] start file recovery. in the, select the file system type where the file partition is stored , and then press ENTER.

Select the file system type to recover deleted files

Next, as shown, choose whether to analyze only the free space or the entire partition. Note that selecting the entire partition will make the operation process longer and slower. After selecting the appropriate option, press ENTER to continue.

Select File System for analysis

Select a directory to store the files that will be recovered, and then press the key to continue after the selection is complete C . Select a directory of different partitions to avoid overwriting deleted files when more files are stored on this partition.

Press the left ARROW to return to the root partition.

Select the directory where you want to save the recovered files

Displays the deleted files of the specified type that are being recovered. You can press ENTER to stop the operation.

Note: in the process of recovery, your system will become very slow, it is likely to be stuck for a period of time, please wait patiently until the recovery is complete.

Recover deleted files in Linux system

Finally, the Photorec tool will show the number of recovered files and the saved paths.

Summary of Linux File recovery

By default, recovered files will be saved with root account privileges, so you will need to open the File Manager as an elevated permission to access these files.

Use the following command (specify your file Manager):

1. $ gksudo nemo
2. 或
3. $ gksudo nautilus

For more information, visit PHOTOREC website: http://www.cgsecurity.org/wiki/PhotoRec.

That's it! In this article, we clarified the use of the PhotoRec tool to recover every step of a deleted or lost file on disk. This is the most reliable and effective recovery tool I have used so far, and if you know there are other similar tools, please share them with you in the comments.

Author Profile:

Aaron Kili is a Linux system and f.o.s.s enthusiast who is about to become a system administrator and web Developer, he is now a content creator of the Tecmint website, he likes to work with computers, and he believes that sharing knowledge is a virtue.

via:http://www.tecmint.com/photorec-recover-deleted-lost-files-in-linux/

Aaron Kili Translator: rusking proofreading: Jasminepeng

This article was compiled by LCTT original, Linux China honors launched

Use PhotoRec & TestDisk tools to recover files under a Linux system