Recover deleted files on Linux

Question

Is there a command to recover/undelete deleted files by rm?

rm -rf /path/to/myfile

How can I recover myfile? If there is a tool to do this, how can I use it?

Before you do anything, mount the filesystem read-only to make sure the data is not overwritten. Also, take a look at this post: http://superuser.com/questions/170857/ext4-undelete-utilities. — , Jun 21 '13 at 15:49
@EvanTeitelman you mean remount read-only is better than try to recover the file while it is umounted? btw, midnightcommander (mc) way, suggests umounting http://www.datarecoverypros.com/recover-linux-midnightcommander.html — Aquarius Power, Aug 16 '15 at 03:34

slm · Accepted Answer · 2023-04-21T03:48:18.553

103

The link someone provided in the comments is likely your best chance.

Linux debugfs Hack: Undelete Files

That write-up though looking a little intimidating is actually fairly straight forward to follow. In general the steps are as follows:

Use debugfs to view a filesystems log
```
 $ debugfs -w /dev/mapper/wks01-root
```
At the debugfs prompt
```
 debugfs: lsdel
```

Sample output

 Inode  Owner  Mode    Size    Blocks   Time deleted
 23601299      0 120777      3    1/   1 Tue Mar 13 16:17:30 2012
 7536655      0 120777      3    1/   1 Tue May  1 06:21:22 2012
 2 deleted inodes found.

Run the command in debugfs
```
 debugfs: logdump -i <7536655>
```

Determine files inode

 ...
 ...
 ....
 output truncated
     Fast_link_dest: bin
     Blocks:  (0+1): 7235938
   FS block 7536642 logged at sequence 38402086, journal block 26711
     (inode block for inode 7536655):
     Inode: 7536655   Type: symlink        Mode:  0777   Flags: 0x0   Generation: 3532221116
     User:     0   Group:     0   Size: 3
     File ACL: 0    Directory ACL: 0
     Links: 0   Blockcount: 0
     Fragment:  Address: 0    Number: 0    Size: 0
     ctime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
     atime: 0x4f9fc730 -- Tue May  1 06:21:20 2012
     mtime: 0x4f9fc72f -- Tue May  1 06:21:19 2012
     dtime: 0x4f9fc732 -- Tue May  1 06:21:22 2012
     Fast_link_dest: bin
     Blocks:  (0+1): 7235938
 No magic number at block 28053: end of journal.

With the above inode info run the following commands

 # dd if=/dev/mapper/wks01-root of=recovered.file.001 bs=4096 count=1 skip=7235938
 # file recovered.file.001
 file: ASCII text, with very long lines

Files been recovered to recovered.file.001.

Other options

If the above isn't for you I've used tools such as photorec to recover files in the past, but it's geared for image files only. I've written about this method extensively on my blog in this article titled:

How to Recover Corrupt jpeg and mov Files from a Digital Camera's SDD Card on Fedora/CentOS/RHEL.

edited Apr 21 '23 at 03:48

answered Jun 21 '13 at 15:49

slm

369,824

30

I tried with debugfs -w /dev/sdb2 but lsdel sais: 0 deleted inodes found. – rubo77 Sep 11 '13 at 07:54
It working, but sometimes. – pylover Sep 17 '13 at 20:46
8

using extundelete is easier for ext3/4 and would probably lead to the same results. – eadmaster Jun 16 '15 at 19:54
1

this worked to recover a file, but I received
��@y��U��T6 �Ԝ��*e�0�� v'��T�0�<#selinuxsystem_u:object_r:rpm_var_lib_t:s0��}y��U��T6..... trying conv=ascii, conv=ibm, and conv=ebcdic yields same problem
– codyc4321 Aug 04 '15 at 18:20
9

lsdel: Filesystem not open,how to resolve it? – 王奕然 Oct 22 '15 at 09:38
@wangyiran - if you have a new Q I encourage you to ask it. – slm Oct 22 '15 at 13:23
2

photorec currently can recover at least 483 different file types, including lots of archives, office-type files, and many "miscellaneous" files, and you can add your own "custom signatures" too. It's apparently changed a lot since it was a photos-only recovery program. – Xen2050 Jan 10 '16 at 01:28
In photorec (from package testdisk) you can set the extensions of files that you wanna recover. Is not using any kind of inode data, it's totally raw and is not comparable on what extundelete does. Both are good pieces of software. – m3nda May 29 '16 at 17:50
8

I get /dev/mapper/wks01-root: No such file or directory while opening filesystem Where did you get this /dev/mapper/wks01-root from? – Marko Avlijaš May 02 '17 at 12:04
@marko don't remember but I think that it's an example of a lvm logical volume. That's the root volume. – slm May 02 '17 at 13:41
I get this output: https://pastebin.com/jv7wfGJ9
What number must I put to skip parameter of dd and what's the logic?
– Marco Sulla Jun 24 '19 at 09:30
1

lsdel is showing me some files deleted months ago? – felwithe Sep 25 '19 at 12:40
2

debugfs Does NOT work on ext4 journal systems using Ubuntu18.04LTS. – mccurcio May 13 '20 at 16:39
To fix the issue with No such file or directory while opening filesystem, do ls /dev/mapper and find your root volume. Then use debugfs -w /dev/mapper/[YOUR ROOT VOLUME] If is says permission is denied, then just use sudo of course. – Rick Mac Gillis Oct 11 '21 at 17:40
9

This does NOT work on ext3 or ext4, so it’s unfortunately quite useless. The debugfs manual states that: "This command was useful for recovering from accidental file deletions for ext2 file systems. Unfortunately, it is not useful for this purpose if the files were deleted using ext3 or ext4, since the inode's data blocks are no longer available after the inode is released." – Arcturus B Nov 19 '21 at 09:59
I wrote a detailed photorec tutorial too. I just added this answer which links to my other answer with the full tutorial here. – Gabriel Staples Apr 21 '23 at 01:22
Your photorec tutorial link seems to be dead. You might just link people to my answer instead. Also, photorec now handles 480 file types from 300 families, not just photos. See the quote in my answer. – Gabriel Staples Apr 21 '23 at 01:24
1

@GabrielStaples - thank you but not necessary, I fixed the broken link. – slm Apr 21 '23 at 03:48

score 67 · Answer 2 · edited May 09 '23 at 06:50

67

If you know a very specific pattern in your deleted files, use `grep` to search in the hard-drive (maybe browse your clipboard to search a pasted line, or vim yank):

grep -a -C 300 -F 'known fixed string in deleted file' /dev/sda > ~/recover

then edit ~/recover to keep only what was your file before by editing. With by example vim editor, that will be a simple task.

Hey, if with Unix philosophy all is files, it's time to take advantage of this, no ?

Explanations

-a is meant to grep even binary data
-C<NUM> specifies lines of output context from before and after each match of the string; you can use -B<NUM> to include lines before each match or -A<NUM> to include lines after each match instead
-F fixed string

Another approach, using potential remaining `F`ile `D`escriptor

With a bit of chances, sometimes I can recover deleted files with this :

#!/bin/bash
export LANG=C
if [[ ! $1 || $1 == -h || $1 == --help ]]; then
    echo -e "Usage:\n\n\t$0 '[path/]<file name>'"
    exit 1
fi
files=(
    $(file 2>/dev/null /proc//fd/ |
        grep "(deleted)'$" | 
        sed -r 's@(:.*broken\s+symbolic\s+link\s+to\s+.|(deleted).$)@ @g' |
        grep "$1" |
        cut -d' ' -f1
    )
)
if [[ ${files[@]} ]]; then
    for f in ${files[@]}; do
        echo "fd $f match... Try to copy this fd to another place quickly!"
    done
else
    echo >&2 "No matching fd found..."
    exit 2
fi

edited May 09 '23 at 06:50

Stephen Kitt

434,908

answered Nov 03 '13 at 19:16

Gilles Quénot

33,867

12

Your grep based solution is very clever and worked for me, even with the file system still mounted. Thanks! – wchargin Nov 27 '14 at 20:16
2

I don't understand how the grep solution worked for you, it outputs only binary data. How is that useful? – w00t Aug 15 '16 at 00:33
3

@w00t Sure, it "only" spits out binary data. But sometimes that binary data happens to contain the ASCII bits corresponding to the file I'm looking for. I guess I don't understand the question? – wchargin Sep 05 '16 at 02:17
2

@w00t the trick is to use a search pattern that is very specific to that file. The grep command will take the 500 lines before and after each matching line, so it will still spit out a lot of irrelevant data, but with a text editor that can cope with that (e.g. Vim), it's easy to sort out the good from the bad stuff. You could also filter out all lines with nonprintable characters by piping it through another grep command: grep -av "[^[:print:]]" – JimmyMcHoover Mar 28 '17 at 19:12
1

The grep solution worked for me with a modification: I did sudo grep --line-buffered -ab "$PATTERN" /dev/sda1 | tee lines and got byte offsets (like 123123123:line\n456456456:another\n...), then did n=1000; sudo dd of=before if=/dev/sda1 ibs=1 skip=$[123123123-$n] count=$n and n=1000; sudo dd of=after if=/dev/sda1 ibs=1 skip=123123123 count=$n with different n values. – Kirill Bulygin Oct 05 '17 at 11:38
Thanks. I was wondering if your solution can recover a pdf file containing some text or binary content? https://unix.stackexchange.com/questions/564219/how-may-i-recover-a-lost-pdf-file – Tim Jan 26 '20 at 19:28
This script did not work AFAIK on Ubuntu 18.04LTS and ext4 journal system – mccurcio May 13 '20 at 16:40
Grep told me "memory exhausted". A little reading tells me that it loads each "line" into memory, but if you have large binary files with no / few newline characters it will try to load the entire chunk. – Jeffrey Blattman May 23 '22 at 19:02
Script is updated, there's was a bug, $1 was not processed. Oups :) – Gilles Quénot Feb 15 '23 at 17:24
1

You saved me few hours! Big THANK YOU! – Volodymyr Krupach Feb 24 '23 at 10:37
1

Lifesaver!! I lost an uncommited file, and the first method helped me restore it. I got some binary stuff along which i found the entire file contents wrapped on a single line. I copied it and reformatted it. – Hussein Hijazi Aug 17 '23 at 14:54

score 54 · Answer 3 · edited Feb 21 '19 at 12:32

54

What worked for me was given by arch (only applies to text files):

grep -a -C 200 -F 'Unique string in text file' /dev/sdXN

where /dev/sdXN is the partition containing the lost file (check with mount if unsure).

Takes a little while, but worked when I accidentally deleted some source code I hadn't commited yet!

edited Feb 21 '19 at 12:32

h22

389

answered Jun 28 '17 at 11:12

William Becker

699

8

Very useful for programmers!. usually, we always lost our own codes. – pylover Jun 28 '17 at 11:30
3

tell me about it, I accidentally ran rm data/*.json python myFile.py instead of rm data/*.json && python myFile.py – William Becker Jun 30 '17 at 09:03
4

Thanks mate, you just helped me recover a text file I spent 2 hours writing at night. P.S. /dev/sdXN is for the file system, right? I found mine with df -T | awk '{print $1,$2,$NF}' | grep "^/dev" – Alex Apr 15 '18 at 16:31
I see just the binary of the file. Is there a way to convert it to normal format? – silgon Sep 21 '18 at 07:25
grep: conflicting matchers specified – felwithe Sep 25 '19 at 12:49
I have 250 gb how long it takes ? @pylover ? – USERNAME GOES HERE Aug 02 '20 at 12:39
If it takes long, you can redirect output into file with > and then analyze in quietly in the editor. May be better not to redirect to the file on the same device of course but eve this way worked for me. It even was not long, even if my SSD is 468G – h22 Feb 15 '23 at 14:59
Just a copy to my answer done in 2013: https://unix.stackexchange.com/revisions/98700/2 – Gilles Quénot Feb 15 '23 at 17:21

score 27 · Answer 4 · edited May 17 '23 at 08:32

27

Recovery Tools - Command Line:

testdisk - open source, dir-structure
photorec - open source, NTFS
extundelete - open source

Recovery Tools - GUI:

R-Linux - proprietary, free, dir-structure
R-Studio - proprietary, paid, dir-structure, NTFS
UFS Explorer - proprietary, paid, dir-structure, NTFS
Recovery Explorer - proprietary, paid, dir-structure, NTFS

Info:

In my personal experience, I get my data back using ufs-explorer and photorec.

Sources: Linuxhacks.org
Disclosure: I am the owner of Linuxhacks.org

edited May 17 '23 at 08:32

AdminBee

22,803

answered Jun 10 '18 at 04:21

intika

14,406

1

R-Linux got me the deleted files back, thx! – lowtechsun May 17 '21 at 19:14
testdisk works well on exfat partition – rodvlopes Feb 12 '22 at 23:07
testdisk worked like a charm. My only problem was picking which of the many copies of the target files was the most recent. A little scary running a program like this, as root but desperate times.. – Jeffrey Blattman May 23 '22 at 19:04

NoUmlautsAllowed · Answer 5 · 2017-08-04T18:27:56.840

17

Although this Question is solved and a few years old, I want to mention the testdisk utility.

How to recover files with testdisk is explained well in this tutorial. To recover files run testdisk /dev/sdX and select your partition table type. After this, select [ Advanced ] Filesystem Utils, then choose your partition and select [Undelete]. Now you can browse and select deleted files and copy them to another location in your filesystem.

edited Aug 04 '17 at 18:27

answered Aug 02 '17 at 07:57

NoUmlautsAllowed

171

This seems to only apply to FAT partitions, though, which are uncommon on *nix. – Aurelius Sep 10 '21 at 11:58
Yes, the tutorial applies to FAT filesystems. Testdisk itself should also work with filesystems which are more common on *nix, like Ext2 or Ext3. At least that's what the testdisk man page says. I didn't try it though. (@Aurelius Sorry for the late response btw.) – NoUmlautsAllowed Oct 26 '21 at 18:00

score 12 · Answer 6 · edited Feb 10 '16 at 14:27

12

An alternative may be using del instead of rm for deleting:

http://fex.belwue.de/fstools/del.html

del has an undelete function and works with any file system.

Of course it is not a solution if you have already deleted your files with "take no prisoners" rm :-}

edited Feb 10 '16 at 14:27

don_crissti

82,805

answered Feb 10 '16 at 14:08

Framstag

169

5

Not an answer as you have already said, but thanks for introducing the del command. – pylover Feb 12 '16 at 08:26
1

I would also mention trash-cli by Andrea Francia ( https://github.com/andreafrancia/trash-cli ), perhaps a more "modern" tool. It integrates with the FreeDesktop.org Trash, it's a completely CLI tool and it can be found in most Linux distributions. – Gianluca Frustagli Oct 30 '21 at 21:35

score 7 · Answer 7 · edited Jan 26 '20 at 22:14

7

I had the same problem last week and I tried a lot of programs, like debugfs, photorec, ext3grep and extundelete. ext3grep was the best program to recover files. The syntax is very easy:

ext3grep image.img --restore-all

or:

ext3grep /dev/sda3 --restore-all --after `date -d '2015-01-01 00:00:00' '+%s'` --before `date -d '2015-01-02 00:00:00' '+%s'`

This video is a mini tutorial that can help you.

edited Jan 26 '20 at 22:14

Stephen Kitt

434,908

answered Oct 19 '15 at 12:35

Juan

81

Didn't work on my ext4 drive, and I don't think there's an ext4grep. – Sridhar Sarnobat Aug 08 '20 at 03:33

score 6 · Answer 8 · edited Apr 13 '17 at 12:36

6

connect drive through external interface

mount
umount /dev/{sd*}
extundelete --restore-all /dev/{sd*}
results go to home folder on boot drive
bonus points: write a GUI for this

See this link for more info: undelete a just deleted file on ext4 with extundelete.

edited Apr 13 '17 at 12:36

Community

1

answered Oct 15 '14 at 11:37

GRZ

89

3

Nice! Thanks for posting. extundelete is a new tool for me. I used this today and found it extremely helpful. Much more helpful IMO than the accepted answer. The only things I would add to this answer to improve it slightly are (1) to reiterate the instructions in some other answers that one should power down the affected computer as soon as one realizes that the files were mistakenly deleted, and (2) to boot from a liveCD or liveUSB OS like Kali Linux which includes the extundelete utility (I found that many other liveCDs like Debian Jessie do not include this utility on their install media). – Kevin Ford The Submariner Mar 13 '17 at 16:22

Alban Kaperi · Answer 9 · 2021-08-01T16:35:40.463

Recover deleted files with ext4magic

sources to read: https://wiki.archlinux.org/title/File_recovery#TestDisk_and_PhotoRec

Ext4magic is another recovery tool for the ext3 and ext4 file system.

Be very careful:

you must be in a different location, not in the HDD you are trying to recover. The best way is to make a clone of the HDD you are trying to recover, so you can try with different methods.
You should not write anymore in the disc that you want to recover.
This method works only for ext3 and ext4 file-systems, so please check what file system you are using before starting.

Example without cloning the HDD:

Before beginning, check what file system you have with the above command:

$ df -Th
Filesystem     Type      Size  Used Avail Use% Mounted on
dev            devtmpfs  3,9G     0  3,9G   0% /dev
run            tmpfs     3,9G  1,8M  3,9G   1% /run
/dev/sda2      ext4      458G  151G  284G  35% /
tmpfs          tmpfs     3,9G  4,3M  3,9G   1% /dev/shm
tmpfs          tmpfs     3,9G   56M  3,8G   2% /tmp

After you determine that you are using ext3 or ext4, go on and plug an external HDD drive and open the terminal from the external HDD

To recover all files, deleted in the last 24 hours:

ext4magic /dev/sdXY -r

To recover a directory or file:

ext4magic /dev/sda2 -f path/to/lost/file -r

The small R flag -r will only recover complete files, that were not overwritten. To also recover broken files, that were partially overwritten, use the big R flag -R. This will also restore not-deleted files and empty directories.

The default destination is ./RECOVERDIR which can be changed by adding the option -d path/to/dest/dir.

If a file exists in the destination directory, the new file is renamed with a trailing hash sign #.

To recover files deleted after 'five days ago':

ext4magic /dev/sdXY -f path/to/lost/file -a $(date -d -5days +%s) -r

score 3 · Answer 10 · answered Jun 24 '21 at 19:54

3

ext4magic just successfully restored my deleted files (including the correct filenames!), after several other methods were not successful.

answered Jun 24 '21 at 19:54

Zulakis

202

Gabriel Staples · Answer 11 · 2023-09-07T23:29:02.667

Recovering deleted or lost files using `photorec` and other tools

photorec can recover "more than 480 file extensions (about 300 file families)". See the full list here: https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec.

I have written detailed instructions on recovering files using it, originally posted on Ask Ubuntu here. I have now moved that portion of that answer to here below.

I used photorec earlier today (20 Apr. 2023) to recover 192 images taking up 3.2 GB on an SD card from 2012! All images were stored to the SD card in Nov. 2012, and were subsequently deleted. The SD card has (I think) undergone multiple "reformats" since then, and photorec still found the photos from 11 years ago! It did not, however, find the 50 photos from today that we really wanted. That stinks, but it is probably because the card is damaged from old age and wear and didn't even write the photos taken today in the first place, whereas the photos from 12 years ago were written correctly back then. So, I'm guessing that the inability of phototrec to find the photos from today is not due to photorec, but is rather due to the hardware of the SD card and its flash memory controller. I can't be sure though.

Anyway, here are my full instructions from today!:

How to recover files or images from a corrupted camera SD card, memory card, drive, or disk (or just deleted files)

Tested 20 Apr. 2023 on Ubuntu 20.04 with photorec --version PhotoRec 7.1, Data Recovery Utility, July 2019.

This is how I got all of my .cr2 files I then needed to convert to .jpg and .png images as described in my other answer here.

Plug in your sdcard to your computer. Open the gparted GUI to see which device the card is. Ex: mine is /dev/sdb. We need this for the next commands.
Close gparted now, or else it will block the mount from showing up in your file manager later when we run the udisksctl command to mount the image.

Copy all bytes from the card into an image file, so that if the card permanently fails, we still have what data we could get.

# try to copy the data from the card once
time sudo ddrescue -d /dev/sdb sdcard.img ddrescue.log
# try 3 times to read any bad sectors which were previously marked by writing 
# their addresses into the ddrescue.log file
time sudo ddrescue -d -r3 /dev/sdb sdcard.img ddrescue.log

Here is a sample run and output of both commands above on a 4 GB SD card:

$ time sudo ddrescue -d /dev/sdb sdcard.img ddrescue.log
[sudo] password for gabriel: 
GNU ddrescue 1.23
Press Ctrl-C to interrupt
     ipos:    4072 MB, non-trimmed:        0 B,  current rate:  10878 kB/s
     opos:    4072 MB, non-scraped:        0 B,  average rate:  15785 kB/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    4072 MB,   bad areas:        0,        run time:      4m 17s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished
real    4m25.189s
user    0m1.399s
sys 0m18.838s
$ time sudo ddrescue -d -r3 /dev/sdb sdcard.img ddrescue.log
[sudo] password for gabriel: 
GNU ddrescue 1.23
Press Ctrl-C to interrupt
Initial status (read from mapfile)
rescued: 4072 MB, tried: 0 B, bad-sector: 0 B, bad areas: 0
Current status
     ipos:        0 B, non-trimmed:        0 B,  current rate:       0 B/s
     opos:        0 B, non-scraped:        0 B,  average rate:       0 B/s
non-tried:        0 B,  bad-sector:        0 B,    error rate:       0 B/s
  rescued:    4072 MB,   bad areas:        0,        run time:          0s
pct rescued:  100.00%, read errors:        0,  remaining time:         n/a
                              time since last successful read:         n/a
Finished
real    0m5.310s
user    0m0.036s
sys 0m0.000s

Change the owner of sdcard.img to my username and group:
```
sudo chown "$USER:$USER" sdcard.img
```
Manually eject and remove the SD card. Be sure to right-click on your SD card in your file manager GUI and go to "Eject" or "Safely remove drive" or whatever. Then, wait for the prompt which says it's okay to remove it, before removing it, or else you risk further data corruption.

Mount the sdcard.img image we produced above. See here.

# mount the image
udisksctl loop-setup --file sdcard.img
You will see a new disk pop up in your file manager GUI. Click on it.
Make note of the path it goes to.
Ex: /media/gabriel/EOS_DIGITAL
Now look for that path here, and make note of the loop filesystem that
path is mounted to!:
df -h
Example, mine is this:
/dev/loop13p1              3.8G  160K  3.8G   1% /media/gabriel/EOS_DIGITAL
We will need this /dev/loop13p1 part in the recovery process.

Now recover the data, following the instructions here: https://www.tomshardware.com/how-to/recover-deleted-files-from-any-drive-in-linux. In short:

sudo apt install testdisk
Open the terminal GUI-like interactive program to do the recovery!
sudo photorec
Make your selections appropriately. Choose to recover from the
/dev/loop13p1 image/filesystem you mounted above.
Note: you'll have to specify an output folder too. Manually make a folder
to store recovered images, and tell the GUI-like program to use it.

When done, you may have a bunch of .cr2 images in your specified output recovery folder.

And that brings us to my other answer here! Convert those unfriendly .cr2 images into usable .jpg or .png images by following the steps in that answer under the section titled "How to batch convert hundreds of .cr2 images into .jpg or .png images".

If that worked for you: the end.

Also check out the paid EaseUS tool below. I'd be willing to bet it's a more-effective product for those willing to pay for it.

Other file recovery tools

There are some other alternatives listed here: https://alternativeto.net/software/easeus-data-recovery-wizard/?platform=linux

Alos, EaseUS, a paid option, has written a really great article here, mentioning 5 total Linux data recovery options, with 4 of them being free and open source and no-cost: EaseUS.com: 2023 Best Free Linux Data Recovery Software for EXT2/EXT3.

The 4 free ones that EaseUS mentions are:

R-Linux
1. This one looks the most useful and robust to me! It would be one of the first ones I'd try after photorec, shown above.
2. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part2
3. https://www.r-studio.com/free-linux-recovery/
4. https://www.r-tt.com/downloads/Free_Linux_Recovery_Manual.pdf
TestDisk
1. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part3
2. https://en.wikipedia.org/wiki/TestDisk
ddrescue
1. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part4
2. https://www.gnu.org/software/ddrescue/
PhotoRec
1. This is the one I have had good success with, and present above!
2. https://www.easeus.com/data-recovery/linux-ext2-ext3-data-recovery-freeware.html#part5
3. https://en.wikipedia.org/wiki/PhotoRec

Other:

recoverjpeg:
1. You can try recoverjpeg too. Follow instructions here: https://linuxnightly.com/how-to-recover-deleted-photos-in-linux-with-recoverjpeg/. But, in my case, photorec was able to recover 258 files, including 192 images taking up 3.2 GB, while recoverjpeg was only able to recover 11 JPEG images taking up 19.8 MB. So photorec is the clear winner in my case! Try both out for yourself though.

Paid file recovery tools:

EaseUS
1. I'm sure there are many paid tools out there, but the first one I'd recommend trying is EaseUS, even though it's expensive (start by trying the "Free Trial" option first!). I recommend it since it's mentioned by Tom's Hardware here (Tom's Hardware: How to Securely Erase an SSD or HDD Before Selling It or Your PC -> search the page for "EaseUS"), and I trust Tom's Hardware.
2. The major con of EaseUS is that is runs on Windows and Mac only! It can recover Linux filesystems, but to do so, you must run the software on a Windows boot disk on your Linux machine, for example, or you must remove your Linux hard drive, put it into an external enclosure, and plug it into a Windows or Mac machine. Personally, I'd try the Windows boot disk option using a free Windows ISO image directly from Microsoft.

References

Recovering files and images:

Google search for "linux ddrescue into file": https://www.google.com/search?q=linux+ddrescue+into+file&oq=linux+ddrescue+into+file&aqs=chrome..69i57.13329j0j9&sourceid=chrome&ie=UTF-8
1. ***** https://www.technibble.com/guide-using-ddrescue-recover-data/
Google search for "linux recover deleted images" - https://www.google.com/search?q=linux+recover+deleted+images&oq=linux+recover+deleted+images&aqs=chrome..69i57.3625j0j7&sourceid=chrome&ie=UTF-8
1. ***** https://www.tomshardware.com/how-to/recover-deleted-files-from-any-drive-in-linux
How to mount an image: https://unix.stackexchange.com/a/619834/114401
my answer on ddrescue and stuff
My blog post on ddrescue: https://www.electricrcaircraftguy.com/2018/01/how-to-clone-your-hard-drive.html
Official photorec and testdisk wikis, by CGSecurity.org, their maker: https://www.cgsecurity.org/wiki/PhotoRec
List of all file formats/extensions which can be recovered by photorec: https://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec

Recover deleted files on Linux

14 Answers14

Other options

If you know a very specific pattern in your deleted files, use `grep` to search in the hard-drive (maybe browse your clipboard to search a pasted line, or vim yank):

Explanations

Another approach, using potential remaining `F`ile `D`escriptor

Recover deleted files with ext4magic

Recovering deleted or lost files using `photorec` and other tools

How to recover files or images from a corrupted camera SD card, memory card, drive, or disk (or just deleted files)

You will see a new disk pop up in your file manager GUI. Click on it.

Make note of the path it goes to.

Ex: `/media/gabriel/EOS_DIGITAL`

Now look for that path here, and make note of the loop filesystem that

path is mounted to!:

Example, mine is this:

/dev/loop13p1 3.8G 160K 3.8G 1% /media/gabriel/EOS_DIGITAL

We will need this `/dev/loop13p1` part in the recovery process.

Open the terminal GUI-like interactive program to do the recovery!

Make your selections appropriately. Choose to recover from the

`/dev/loop13p1` image/filesystem you mounted above.

Note: you'll have to specify an output folder too. Manually make a folder

to store recovered images, and tell the GUI-like program to use it.

Other file recovery tools

The 4 free ones that EaseUS mentions are:

Other:

Paid file recovery tools:

References

See also

Linked

Related

Recover deleted files on Linux

14 Answers14

Other options

If you know a very specific pattern in your deleted files, use grep to search in the hard-drive (maybe browse your clipboard to search a pasted line, or vim yank):

Explanations

Another approach, using potential remaining File Descriptor

Recover deleted files with ext4magic

Recovering deleted or lost files using photorec and other tools

How to recover files or images from a corrupted camera SD card, memory card, drive, or disk (or just deleted files)

You will see a new disk pop up in your file manager GUI. Click on it.

Make note of the path it goes to.

Ex: /media/gabriel/EOS_DIGITAL

Now look for that path here, and make note of the loop filesystem that

path is mounted to!:

Example, mine is this:

/dev/loop13p1 3.8G 160K 3.8G 1% /media/gabriel/EOS_DIGITAL

We will need this /dev/loop13p1 part in the recovery process.

Open the terminal GUI-like interactive program to do the recovery!

Make your selections appropriately. Choose to recover from the

/dev/loop13p1 image/filesystem you mounted above.

Note: you'll have to specify an output folder too. Manually make a folder

to store recovered images, and tell the GUI-like program to use it.

Other file recovery tools

The 4 free ones that EaseUS mentions are:

Other:

Paid file recovery tools:

References

See also

Linked

Related

If you know a very specific pattern in your deleted files, use `grep` to search in the hard-drive (maybe browse your clipboard to search a pasted line, or vim yank):

Another approach, using potential remaining `F`ile `D`escriptor

Recovering deleted or lost files using `photorec` and other tools

Ex: `/media/gabriel/EOS_DIGITAL`

We will need this `/dev/loop13p1` part in the recovery process.

`/dev/loop13p1` image/filesystem you mounted above.