GNet Solutions » GNU/Linux Administration

I recently deleted a file on one of my thumb drives by accident, and I really needed that file back. Luckily there is an application for this very task, called testdisk. This is how I recovered my file using testdisk.

NOTE: Once a file has been deleted, it is only marked deleted by the filesystem and the space is marked free to be written to. If new data is written to the disk before the file is recovered, the file being recovered may be overwritten by the new data.

Recover Data¶

• Install testdisk:
  

  sudo pacman -S testdisk
  

• Make a temporary directory to store a copy of the recovered data:
  

  mkdir ~/temp-recovered
  

• Run testdisk:
  

  sudo testdisk /dev/sdb
  

  
  NOTE: Replace /dev/sdb with the proper path of the drive to be recovered.

• Once testdisk is open, select the device to perform the recovery on, then select Proceed.

• Select Intel as the partition type.

• Select Advanced.

• Select the Partition to perform the recovery on and the choose Undelete.

• Navigate to the location on the device where the files were deleted. Files that are deleted are displayed in red text.

• Use the : key to select the files that were deleted, then press C to open the destination folder prompt.

• Select temp-recovered directory created earlier, then press C again to copy the selected files to a new location.

The files will be recovered into the temporary recovery folder in the same exact directory structure as the recovered drive.

Resources¶

• https://wiki.archlinux.org/index.php/file_recovery#Testdisk_and_PhotoRec
• http://www.cgsecurity.org/wiki/TestDisk:_undelete_file_for_FAT