Have you ever deleted a file and regret it right away? You need it back, and fast! But what if the file is so new and it hasn̵
rm: Abbreviation for Remorse?
It’s all too easy to get the
rm command and find yourself staring at a terminal window with a deeper sense of regret. A small wildcard mistake, and you can wipe out a lot more than you intended.
The standard Linux file system,
ext4 uses inodes to hold data about each file and an inode table to keep track of the inodes. The inode contains metadata about the file, such as its name, who owns it, what the permissions are, and so on.
It also includes hard link entry points pointing to the file. Each file has at least one hard link. Each time you create a new hard link, the number of hard links increases by one. Each time you delete a hard link, the number of hard links in the inode is reduced by one.
When you delete a file that has the inode marked as unused (and ready for reuse), the last hard link will be deleted. When this happens, the file does not appear in the directory entries and cannot be used or opened.
However, the data that makes up the contents of the file is still present on the hard drive. If you could patch the inode to contain the correct information, the file would be restored. Of course, this would only work if the data that makes up the file on the hard drive is left intact and not overwritten.
You can also create a new inode, copy the leftover data from the old inode, and then replace the missing bits.
These are not trivial activities. If you accidentally delete a file, it’s usually at the worst possible time. It’s always when you need that file, and you need it now. You don’t have time to work with industry editors and other utilities. And if it’s a file you just created, it probably hasn’t been backed up yet, so those won’t help you either.
testdisk comes in. It is easy to use and does not require detailed, low level knowledge of the file system. Let’s see how to use it!
RELATED: Everything you ever wanted to know about inodes on Linux
Install test disk
testdisk on Ubuntu use this command:
sudo apt-get install testdisk
On Fedora you have to type:
sudo dnf install testdisk
You have to use on Manjaro
sudo pacman -Sy testdisk
Use test disk
Although it runs in a terminal window,
testdisk has a rudimentary interface. You use the arrow keys to navigate and Enter to make a selection. To keep everything tidy, it is best to create a folder for recovered files.
We type the following to create a folder named “recovered” for our recovered files:
We type the following to switch to the new directory and start
testdisk from there:
We must use
testdisk, so we type the following:
The first question
testdisk asks is about logging. It can create a new log file, use an existing log file, or log nothing at all. It doesn’t matter which option you choose; it does not affect the road
You can just press Enter to accept the highlighted option and create a new log file. It will be created in the directory you started from
testdisk. If you make your choice,
testdisk asks which hard drive contains the file system you want to work on.
It lists the hard drives it can find, as well as the
squashfs “/ Dev / loop” files. There is one of these for every application you installed from one
snap. They are read-only, so you were unable to delete anything from these file systems.
There is only one physical hard drive in this test machine, so we used the down arrow to highlight the “/ dev / sda” option. We then used the right arrow to select “Proceed” and then hit Enter.
testdisk must also know the partition type. It presents a menu of options along with the type of partition it will automatically detect at the bottom.
Highlight the type of partition that will be automatically detected, then press Enter unless you have good reason not to do so.
Highlight “Advanced” in the function menu that appears and press Enter.
The partition selection menu will appear.
The files we are looking for are located in the Linux file system partition. We only have one Linux partition on our hard drive, but you may have more.
Select the partition where your files were located, use the left and right arrow keys to select “List” and press Enter. The file selection menu appears.
Use the up and down arrows or the PgUp and PgDn keys to navigate through the list of files and folders. Press the right arrow or Enter to enter a directory and the left arrow or Esc to exit a directory.
We are looking for files that were owned by
dave. The files for all user accounts are in the “Home” directory. So we highlight the “Home” directory and then we can press the right arrow or Enter to open that directory.
All user accounts will then be listed for us. We emphasize
daveand then press the Right Arrow or Enter to access that directory.
We can now see the files that come with the
dave account. The items in red have been removed. We navigate through the files and folders until we find the files we want to recover.
To restore a file, highlight it and then press c (lower case).
The screen changes and tells you to choose a destination for the recovered file. Because we created and started a folder called “Recovered”
testdisk out of that, the first item in the list (.) is that directory. To recover this deleted file in that folder, we press C (capital letters).
After doing this, you will be returned to the file selection display. If you want to recover more files, repeat the process. Highlight a deleted file, press c (lower case) to copy it, then press C (upper case) to restore it.
Working with recovered files
After you restore a file, the directory structure is rebuilt to its original location, which is useful as it reminds you where on the hard drive the original file was located. This means that if you need to copy it back, you know where to put it.
If you are recovering a number of files from different file system locations that happen to have the same file name, they will need to be saved separately anyway.
You can type the following to view the contents of the “Recovered” folder:
If you ask
testdisk to create a log file, it is located in the “Recovered” folder. Since our recovered files were located at “/ home / dave”, they were copied to our “Recovered” folder, nested in folders with the same name.
We can go to the copied “dave” directory with
cd. Make sure not to use a leading slash (
/) on the path – you want to change to the local “house”, not the system “/ home”.
We type the following:
The recovered files are in that folder, so we type:
Let’s take another look at the recovered files using the
-l (long list) option:
Because we used
testdisk, the recovered files are restored with “root” as the owner. We can change the owner back to “dave” with
sudo chown dave.dave *
We type the following to ensure correct ownership has been restored:
testdisk: Code for Relief
That feeling of relief after recovering an important file that was just irretrievably lost is something you will always appreciate.
testdisk is such a useful utility. Once you’ve gone through the menus and can start recovering files, it’s easy to fall into a rhythm of highlights, c, C, repeat.