قالب وردپرس درنا توس
Home / Tips and Tricks / How to recover deleted files on Linux with testdisk

How to recover deleted files on Linux with testdisk

An illustration of a terminal window on a Linux computer.
Fatmawati Achmad Zaenuri / Shutterstock

Have you ever deleted a file and regret it right away? You need it back, and fast! But what if the file is so new and it hasn̵

7;t been backed up yet? Fortunately, you can do something about it.

rm: Abbreviation for Remorse?

It’s all too easy to get the rm command and find yourself staring at a terminal window with a deeper sense of regret. A small wildcard mistake, and you can wipe out a lot more than you intended.

The standard Linux file system, ext4 uses inodes to hold data about each file and an inode table to keep track of the inodes. The inode contains metadata about the file, such as its name, who owns it, what the permissions are, and so on.

It also includes hard link entry points pointing to the file. Each file has at least one hard link. Each time you create a new hard link, the number of hard links increases by one. Each time you delete a hard link, the number of hard links in the inode is reduced by one.

When you delete a file that has the inode marked as unused (and ready for reuse), the last hard link will be deleted. When this happens, the file does not appear in the directory entries and cannot be used or opened.

However, the data that makes up the contents of the file is still present on the hard drive. If you could patch the inode to contain the correct information, the file would be restored. Of course, this would only work if the data that makes up the file on the hard drive is left intact and not overwritten.

You can also create a new inode, copy the leftover data from the old inode, and then replace the missing bits.

These are not trivial activities. If you accidentally delete a file, it’s usually at the worst possible time. It’s always when you need that file, and you need it now. You don’t have time to work with industry editors and other utilities. And if it’s a file you just created, it probably hasn’t been backed up yet, so those won’t help you either.

This true testdisk comes in. It is easy to use and does not require detailed, low level knowledge of the file system. Let’s see how to use it!

RELATED: Everything you ever wanted to know about inodes on Linux

Install test disk

to install testdisk on Ubuntu use this command:

sudo apt-get install testdisk

sudo apt-get install testdisk in a terminal window.

On Fedora you have to type:

sudo dnf install testdisk

sudo dnf install testdisk in a terminal window.

You have to use on Manjaro pacman:

sudo pacman -Sy testdisk

sudo pacman -Sy testdisk in a terminal window.

Use test disk

Although it runs in a terminal window, testdisk has a rudimentary interface. You use the arrow keys to navigate and Enter to make a selection. To keep everything tidy, it is best to create a folder for recovered files.

We type the following to create a folder named “recovered” for our recovered files:

mkdir restored

mkdir fixed in a terminal window.

We type the following to switch to the new directory and start testdisk from there:

cd restored/

cd recovered / in a terminal window.

We must use sudo with testdisk, so we type the following:

sudo testdisk

sudo testdisk in a terminal window.

The first question testdisk asks is about logging. It can create a new log file, use an existing log file, or log nothing at all. It doesn’t matter which option you choose; it does not affect the road testdisk works.

The log options in testdisk in a terminal window.

You can just press Enter to accept the highlighted option and create a new log file. It will be created in the directory you started from testdisk. If you make your choice, testdisk asks which hard drive contains the file system you want to work on.

It lists the hard drives it can find, as well as the squashfs “/ Dev / loop” files. There is one of these for every application you installed from one snap. They are read-only, so you were unable to delete anything from these file systems.

A hard disk menu in test disk in a terminal window.

There is only one physical hard drive in this test machine, so we used the down arrow to highlight the “/ dev / sda” option. We then used the right arrow to select “Proceed” and then hit Enter.

testdisk must also know the partition type. It presents a menu of options along with the type of partition it will automatically detect at the bottom.

Partition table type menu in test disk in a terminal window.

Highlight the type of partition that will be automatically detected, then press Enter unless you have good reason not to do so.

Highlight “Advanced” in the function menu that appears and press Enter.

The partition selection menu will appear.

The partition selection menu in test disk in a terminal window.

The files we are looking for are located in the Linux file system partition. We only have one Linux partition on our hard drive, but you may have more.

Select the partition where your files were located, use the left and right arrow keys to select “List” and press Enter. The file selection menu appears.

The File Selection menu in test disk in a terminal window.

Use the up and down arrows or the PgUp and PgDn keys to navigate through the list of files and folders. Press the right arrow or Enter to enter a directory and the left arrow or Esc to exit a directory.

We are looking for files that were owned by dave. The files for all user accounts are in the “Home” directory. So we highlight the “Home” directory and then we can press the right arrow or Enter to open that directory.

All user accounts will then be listed for us. We emphasize daveand then press the Right Arrow or Enter to access that directory.

A home folder in test disk in a terminal window.

We can now see the files that come with the dave account. The items in red have been removed. We navigate through the files and folders until we find the files we want to recover.

Deleted files in TestDisk in a terminal window.

To restore a file, highlight it and then press c (lower case).

The screen changes and tells you to choose a destination for the recovered file. Because we created and started a folder called “Recovered” testdisk out of that, the first item in the list (.) is that directory. To recover this deleted file in that folder, we press C (capital letters).

The file destination menu in TestDisk in a terminal window.

After doing this, you will be returned to the file selection display. If you want to recover more files, repeat the process. Highlight a deleted file, press c (lower case) to copy it, then press C (upper case) to restore it.

Working with recovered files

After you restore a file, the directory structure is rebuilt to its original location, which is useful as it reminds you where on the hard drive the original file was located. This means that if you need to copy it back, you know where to put it.

If you are recovering a number of files from different file system locations that happen to have the same file name, they will need to be saved separately anyway.

You can type the following to view the contents of the “Recovered” folder:


If you ask testdisk to create a log file, it is located in the “Recovered” folder. Since our recovered files were located at “/ home / dave”, they were copied to our “Recovered” folder, nested in folders with the same name.

We can go to the copied “dave” directory with cd. Make sure not to use a leading slash (/) on the path – you want to change to the local “house”, not the system “/ home”.

We type the following:

cd home/dave

The recovered files are in that folder, so we type:


ls in a terminal window.

Let’s take another look at the recovered files using the -l (long list) option:

ls -1

ls -l in a terminal window.

Because we used sudo launch testdisk, the recovered files are restored with “root” as the owner. We can change the owner back to “dave” with chown:

sudo chown dave.dave *

sudo chown dave.dave * in a terminal window.

We type the following to ensure correct ownership has been restored:

ls -l

ls -l in a terminal window.

testdisk: Code for Relief

That feeling of relief after recovering an important file that was just irretrievably lost is something you will always appreciate.

Therefore testdisk is such a useful utility. Once you’ve gone through the menus and can start recovering files, it’s easy to fall into a rhythm of highlights, c, C, repeat.

Source link