How to recover deleted files using Linux

When files are deleted from a Linux system, they are often not permanently removed from the disk immediately. Depending on the type of deletion and file system in use, it may be possible to recover those files. However, recovery success depends on various factors, including whether new data has been written to the disk, overwriting the deleted files.

Recovering deleted files on Linux can be achieved using several methods and tools. These include checking if the files are in the Trash folder, using file recovery utilities, or retrieving files from backups. For files deleted via the command line or permanently removed from the system, special recovery tools may be needed to scan the disk for lost data.

It is important to act quickly when attempting to recover deleted files. Writing new data to the disk could overwrite the deleted files, making recovery impossible. This guide provides methods to recover deleted files using standard Linux tools and recovery utilities.

1. Check the Trash folder for recently deleted files.

   $ ls ~/.local/share/Trash/files/

   If files were deleted through the graphical interface, they are likely in the Trash folder. Use the ls command to check its contents.

2. Use the extundelete tool to recover files from an ext3 or ext4 file system.

   $ sudo extundelete /dev/sda3 --restore-file /path/to/deletedfile

   The extundelete utility is useful for recovering deleted files from ext3 and ext4 file systems. It can recover specific files or an entire partition.

3. Use the testdisk utility to recover deleted partitions or files.

   $ sudo testdisk

   The testdisk tool can recover lost partitions and undelete files from various file systems. Follow the prompts to scan and restore deleted files.

4. Use the photorec tool to recover deleted files from various file systems.

   $ sudo photorec

   Photorec specializes in recovering files such as documents and images from hard drives and other storage devices, regardless of file system type.

5. Check for open file handles on deleted files using the lsof command.

   $ sudo lsof | grep deleted

   If a file is deleted but still being used by a running process, it may be possible to recover it by checking the open file handles with the lsof command.

6. Recover a recently deleted file using debugfs for ext2, ext3, or ext4 file systems.

   $ sudo debugfs /dev/sda3
   debugfs: lsdel

   Debugfs is a file system debugging tool that can help locate and recover recently deleted files on ext2, ext3, and ext4 file systems.

7. Restore files from backup if no recovery tools succeed.

   $ rsync -av /backup/location/ /restore/location/

   If you have regular backups, this is the safest way to restore lost files. Use rsync or similar tools to restore files from your backup location.