How To Recover Deleted Files On Linux With Photorec
There are many different ways to recover deleted files on Linux. However, the most user friendly option is a terminal tool called Photorec. With it, users can easily scan partitions and entire hard drives for lost files. Best of all, the tool works with all different types of file systems, not just Linux ones. Here’s how to use it.
SPOILER ALERT: Scroll down and watch the video tutorial at the end of this article.
Installation
Photorec isn’t something that installs on its own. Instead, it usually comes bundled with Testdisk, a powerful set of recovery tools that allows the user to recover data, back it up and copy it in different ways. The software is widely in use on Linux, especially in enterprise Linux circles. To install it to your Linux PC, open up a terminal and enter the following command to get it.
Ubuntu
sudo apt install testdisk
Debian
sudo apt-get install testdisk
Arch Linux
sudo pacman -S testdisk
Fedora
sudo dnf install testdisk
OpenSUSE
sudo zypper install testdisk
Other Linuxes
Chances are, your Linux operating system has Testdisk, as well as Photorec. However, if for some reason this isn’t the case, consider visiting the official website, and downloading the program directly. The developers make the program available to generic Linux distributions in the form of a tar.bz2 archive file. On the website, it says that the software supports Linux distributions with kernels 2.6 and later.
Obviously Linux distributions in 2017 are very far from kernel 2.6. That said, seeing how it’s a terminal program, users should have no trouble running it.
Recover Data From Hard Drive
To recover data with the Photorec tool open up a terminal window. First, gain root access in the terminal. The terminal needs root, as data recovery doesn’t work that well without superuser privileges. Gain a root shell with this command:
sudo -s
With root gained, start up Photorec:
photorec
As the Photorec app starts up in the terminal, it’ll immediately scan the entire system for block devices (hard drives and other mass storage devices). The scan happens very fast, and when it finishes, a list will appear. Look through the list of drives to determine where you’d like to scan for recently deleted files and folders. Use the arrow keys to highlight an option, then hit the enter key to continue.
Inside the chooser, Photorec will display all partitions on the drive you wish to run a recovery on. To recover from the entire drive, find the option “[whole drive]” and hit the enter key.
On the next page, the program asks what the file system is. Even though Photorec is going to scan the entire hard drive, still select the file system. If the hard drive contains multiple file systems, try to specify the largest one.
For Linux systems, select “Ext2/ext3”. For everything else select “other”.
Note: Run lsblk –fs in the terminal to determine what your hard drive’s file system is.
On the next page, Photorec asks where to scan. It will look through the hard drive, and show various different directories to scan. If you’re certain you know where the file was deleted, use the arrow keys to select the exact location where the program should scan. If not, press c at the first option it shows in the list. This option will scan everything.
After selecting the directory, sit back and wait. The scan may take quite a bit of time (it all depends on how fast and big your hard drive is). When Photorec finishes, it will place several recovered files in the user’s home directory. Keep in mind, this is not one folder. Instead, there are many different ones. Each of the folders share the name “recup”, followed by a number.
Access these recovered files by navigating to the “recup” folders in your home directory.
Recover Data From Individual Partition
Photorec does very well in finding recently deleted files, by scanning all partitions on an entire hard drive. Sometimes, however, it’s better (and faster) to scan one partition at a time. Here’s how to do it.
Step 1: launch Photorec like outlined above in the instructions.
Step 2: select the individual hard drive to scan in the menu.
Step 3: select the individual hard drive partition to scan.
Step 4: In the terminal, run lsblk –fs to determine the type of file system the partition has.
Then, in Photorec, specify the file system type.
Step 5: highlight the directory to scan in on the hard drive partition, and then select the c button to start the process.
Sit back and wait for the scan to complete. When its finished, go to your home directory. All recovered files will be located in folders starting with the word “recup”.
Conclusion
Losing data is terrible, and can really ruin your day. Thankfully, tools like Photorec exist, and make getting those precious files back a reality. If you’ve ever accidentally deleted some things on your Linux PC, do check out this program. You’ll be happy you did!
