Ubuntu – How to recover deleted files

data-recovery

Are there any tools, methods, incantations to recover recently deleted files on Ubuntu?

If it makes any difference, I want to recover a Keepass 2.x database file. But would be better to have a method/tool that works on any kind of file.

Best Answer

TestDisk / PhotoRec

TestDisk can sometimes recover recently deleted files using PhotoRec, which is part of TestDisk. Available on official repo and newer version on their site.

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

PhotoRec is part of TestDisk, and is a file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

Related Solutions

Ubuntu – I deleted a folder in Ubuntu, how can I recover it

Not speaking from personal experience, but I've heard good things about extundelete. You know to unmount the partition with the deleted files immediately, right? And never mount it again, (read-only is ok), until you have finished attempting to recover files?

For best results you'll have to download and build extundelete from source. That partition is still unmounted, right? Easiest though, and again I haven't actually tried this, boot from a live USB/DVD, don't mount the affected partition, sudo apt-get install extundelete (a slightly out of date package is in the Ubuntu Universe repository), cd to a directory on some other mounted partition with sufficient free space to hold your recovered files, and just run the program. You'll want to check the command reference, but the first thing to try should be something like

$ extundelete /dev/sdX --restore-directory /home/user/that/directory/you/deleted.

Ubuntu – Finding files deleted from shared partition

Files "deleted" in other partitions should be temporarily be moved in a .Trash-1000 folder within the same partition they were "deleted" from while pending a "definitive deletion"; this is a hidden folder, so try the following:

Open Files
Open the partition in which the file was deleted
Hit Ctrl+h
Open the .Trash-1000 folder and browse its content

The "deleted" file should be somewhere inside this folder.

If it's not, you can try to recover it with testdisk:

Open a Terminal by hitting Ctrl+Alt+t
Install testdisk: sudo apt-get install testdisk
Run testdisk: sudo testdisk
Choose No Log
Select the drive containing the partition from which the file was deleted and choose Proceed
Choose the partition table type
Choose Analyse
Choose Quick Search
Select the partition from which the file was deleted and hit p
Browse both the folder which used to contain the deleted file and the .Trash-1000 folder and see if your file is listed in red; if it is, select it and hit c
Browse to a folder in which you can copy the recovered file and hit C
Quit testdisk

This should recover the deleted file and copy it in the location specified, altough the file might have been overwritten (and be corrupted) since his deletion from the filesystem entries.

Best Answer

TestDisk / PhotoRec

Related Solutions

Ubuntu – I deleted a folder in Ubuntu, how can I recover it

Ubuntu – Finding files deleted from shared partition

Related Question