How to Recover Lost and Deleted Data in Linux

Consider this scenario, you are pursuing your daily computing objectives on your Linux distribution and later realize you accidentally deleted a file that is paramount to your computing objective.

Also, the file that you deleted cannot even be traced in the system Trash. Your first reaction will be to panic since it is never a comforting feeling to lose data while on a maze called the Linux operating system.

However, this article is here to comfort us from the grief of losing data while in a Linux OS environment.

Problem Statement

Let us for example assume the existence of the following file ‘linuxshelltips‘ on removable media (/dev/sdb5) on our Linux system at (/media/dnyce/117137A85FFD287C) partition.

$ cd /media/dnyce/117137A85FFD287C
$ nano linuxshelltips 
$ cat linuxshelltips

We are going to delete it and later on attempt to recover the lost and deleted data.

$ rm linuxshelltips 
$ ls -l  
Recover Deleted File in Linux
Recover Deleted File in Linux

We have successfully deleted our file and confirmed that is it no longer available on the disk drive. We can now look at a viable solution to recovering our lost data.

Recover Deleted File in Linux Using TestDisk Data Recovery Tool

The TestDisk data recovery tool is not only effective in recovering lost data but also in repairing corrupted filesystems in a Linux environment.

It can be installed on major Linux distributions as depicted below:

$ sudo apt install testdisk         [On Debian, Ubuntu and Mint]
$ sudo yum install testdisk         [On RHEL/CentOS/Fedora and Rocky Linux/AlmaLinux]
$ sudo emerge -a app-admin/testdisk [On Gentoo Linux]
$ sudo pacman -S testdisk           [On Arch Linux]
$ sudo zypper install testdisk      [On OpenSUSE]    

Once installed, switch to the root user account and launch testdisk, and press [Enter] on the highlighted option that states “Create a new log file”.

$ sudo -i
# testdisk
Start Testdisk Recovery Tool
Start Testdisk Recovery Tool

You will be presented with a list of all the disk devices present on your system. Navigate to the one from which you wish to recover your lost data. In my case, the disk drive is /dev/sdb.

Next, use the keyboard arrow keys and navigate to the [Proceed] menu option at the bottom of the disk drive list.

Choose Disk Drive in Linux
Choose Disk Drive in Linux

TestDisk has a tendency of highlighting the most viable option. In this step, go with the default option for partition table type by pressing [Enter] on the keyboard.

Choose Default Partition Table
Choose Default Partition Table

Select the [Advanced] option and hit [Enter] on the keyboard.

Choose Advanced Filesystem Utils
Choose Advanced Filesystem Utils

Navigate to the partition option that reveals the [Undelete] option at the bottom of the terminal window and press [Enter] on your keyboard.

Choose Undelete Option
Choose Undelete Option

As you can see, the linuxshelltips file we created at the root level of our directory is present. There is even a timestamp of the exact date the file was created.

View Deleted Files in Linux
View Deleted Files in Linux

If you have more than one file that needs recovering, use the keyboard key [a] to select/deselect them. To copy multiple selected files, use the keyboard key [C].

To copy a single/current file, use the keyboard key [c]. Since we are dealing with a single file, we will use the keyboard key [c] which will redirect us to the following terminal window.

Copy Deleted File in Linux
Copy Deleted File in Linux

Navigate to the second option.

Choose Destination to Recover Deleted File
Choose Destination to Recover Deleted File

Navigate to the home directory and press [Enter].

Choose Home Directory
Choose Home Directory

Select your system user and press [Enter].

Choose System User
Choose System User

We might want to copy our recovered file to the highlighted Desktop directory using the keyboard key [c].

Recover Deleted File in Linux
Recover Deleted File in Linux

Let us assume we created a sub-directory called recovered inside the Desktop directory.

$ mkdir -p $HOME/Desktop/recovered

We will need to navigate to this directory first…

Choose File Recovery Directory
Choose File Recovery Directory

Afterward, we will press the keyboard button [c] to copy the recovered data. Once your press the [c] key, you will be redirected to this menu once the lost data is recovered.

Recover Deleted File in Linux
Recover Deleted File in Linux

You can now quit TestDisk by using the [q] button to navigate back to the [Quit] button.

Let us confirm if our file was recovered:

$ ls -l recovered
Confirm Linux File Recovery
Confirm Linux File Recovery

Since we used the root user account to recover the file, we need to change the file ownership back to the normal user and confirm the file data validity.
$ sudo cat recovered/linuxshelltips

$ sudo chown user:group recovered/linuxshelltips
$ ls -l recovered/linuxshelltips
$ sudo cat recovered/linuxshelltips
Confirm Linux File Validity
Confirm Linux File Validity

We have successfully recovered our lost file and its data using the TestDisk data recovery tool, which is an effective tool in not only recovering lost and deleted data but also repairing compromised filesystems.

Got something to say? Join the discussion.

Have a question or suggestion? Please leave a comment to start the discussion. Please keep in mind that all comments are moderated and your email address will NOT be published.