How to recover deleted files or folders in Linux

Recovering a deleted file or folder in Linux is mostly a race against new writes on the same filesystem. If the lost data is still in a desktop Trash directory, still open by a running process, or still represented in filesystem metadata, you can often get it back without rebuilding it from scratch.

Linux usually removes the directory entry first and reuses the data blocks later. That leaves three practical recovery paths: restore from Trash when the deletion came from a file manager, copy data from an open deleted file descriptor when a process still has the file in use, or switch to offline recovery tools such as testdisk and photorec when the filesystem itself has to be scanned.

The safest recovery workflow keeps the source filesystem as quiet as possible and writes recovered data to a different disk or partition. If the deleted data lived on the running root filesystem, stop short of aggressive recovery from the live system and boot rescue or live media instead. Current backups or snapshots are still the most reliable recovery method when the missing data is business-critical.

1. Stop writes to the affected filesystem and identify the device or mount point that held the deleted path.

   $ findmnt -no SOURCE,TARGET -T /srv/app/data
   /dev/sdb1 /srv

   Do not install packages, download files, or keep writing logs onto the same filesystem after the deletion. Every new write can overwrite blocks that recovery tools still need.

2. Check the user's Trash directory first when the deletion happened from a graphical file manager.

   $ ls ~/.local/share/Trash/files/
   old-photo.jpg
   project-notes.odt

   Desktop environments such as GNOME and KDE Plasma usually move deleted items into /homeusername.local/share/Trash/files instead of removing them immediately. If the missing folder is there, restore it from the file manager or move it back with mv.

3. If a service or application may still have the deleted file open, recover it from the live file descriptor before restarting anything.

   $ sudo lsof +L1 /tmp
   COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NLINK    NODE NAME
   sh      235 root    3w   REG   0,92       14     0 2905379 /tmp/open-deleted.log (deleted)
   
   $ sudo cp /proc/235/fd/3 /var/tmp/open-deleted.recovered
   $ cat /var/tmp/open-deleted.recovered
   live log line

   Use the PID and file descriptor from your own lsof output. This path works only while the process is still running and the deleted descriptor still exists.
   Related: How to check deleted files still open in Linux

4. Move recovery work to live or rescue media when the deleted data was on the system filesystem or another busy mounted volume.

   For Ubuntu live media, choose Try Ubuntu instead of starting the installer so the internal disks stay offline while you recover data.

5. Confirm that the recovery tools are installed, and add the packages commonly named testdisk and lsof with your distribution package manager if they are missing.

   $ testdisk /version
   TestDisk 7.1, Data Recovery Utility, July 2019
   Christophe GRENIER <grenier@cgsecurity.org>
   https://www.cgsecurity.org
   
   Version: 7.1
   Compiler: GCC 13.2
   ext2fs lib: 1.47.0, ntfs lib: libntfs-3g, reiserfs lib: none, ewf lib: none, curses lib: ncurses 6.4
   OS: Linux, kernel 6.12.76-linuxkit (#1 SMP Sun Mar  8 14:41:59 UTC 2026) aarch64

   On current Ubuntu 24.04, the testdisk package still provides both testdisk and photorec. Other mainstream distributions use the same tool names even when the packaging layout differs.

6. Unmount the affected partition before running metadata-based recovery tools against it.

   $ sudo umount /dev/sdb1

   Do not force recovery tools against a mounted writable filesystem. If the target is the running root filesystem, boot live media and work from there instead.

7. Start with testdisk when you want the best chance of recovering the original filenames and folder structure.

   $ sudo testdisk /dev/sdb

   

   Inside testdisk, select the correct disk, open Advanced for an existing partition, use List or Undelete to browse recoverable entries, mark the files or folders you need, and press C to copy them to a different filesystem.

8. Switch to photorec when the directory tree is too damaged to browse or when testdisk cannot list the deleted entries you need.

   $ sudo photorec

   photorec carves files by signature, so it can recover data even when directory metadata is gone, but recovered names and folder paths are usually not preserved. Save the output to a different disk and narrow the enabled file types in File Opt to reduce noise.
   Related: How to recover deleted files using PhotoRec

9. Verify the recovered files from the destination disk before you reuse the source filesystem.

   $ find /mnt/recovery-out -maxdepth 2 -type f | head
   /mnt/recovery-out/project-notes.odt
   /mnt/recovery-out/images/logo.png

   Open the most important documents, compare file sizes, and restore from backup or snapshots if the recovered copies are incomplete or corrupted. Once you return the source filesystem to normal use, deeper undelete attempts become less reliable.