PhotoRec Recover Deleted or Lost Files in Linux

It is quite a common requirement for users wanting to access the files that they have deleted in the past. This is partly due to misjudgment of the importance of the file, deletion of the file by malicious software, or loss of file due to a File system corruption. Whatever the reason may be, sometimes one just could not prevent their files from getting lost. But on the flip-side, it is quite easy to recover those deleted files (under some conditions). Therefore in this article, you will learn how to recover your lost files on Linux OS using the PhotoRec application.

Recover Deleted or Lost Files in Linux

Follow the below steps to recover lost files in Linux:

Step 1: It is required that PhotoRec be installed onto the command line of your Linux OS. In newer Linux variants it comes by default, but if not present could be installed by running the following command in the terminal:

sudo apt install testdisk

Step 2: For demonstration, we would be creating a file named testing.txt and filling it with the below string.

echo “Hennesy in the Mix” > testing.txt

We have deleted the file testing.txt, and we will now recover it through photorec tool.

Note : All the steps are performed on Kali Linux. But the same method is applicable to all Linux variants.

Step 2: Enter the following command in the terminal to launch the photorec application.

sudo photorec

A new window similar to this would have appeared

This is the list of storage devices recognized by the Operating System.

Step 4: From there select the disk from where you are wanting to recover your file by pressing Enter.

Step 5: Now you would see a list containing the partitions present in the Disk selected in the previous step.

Now select the partition in which the file initially resided.

Step 6: The following page would have appeared:

We want to know the filesystem in which the file was stored photorec is wanting to know the filesystem in which the file was stored at. In Linux ext2, ext3, and ext4 are some of the commonly used File systems. From this list select the Filesystem.

Step 7: Now the program would offer a choice for determining whether the free space or the whole space in the partition needs to be analyzed for file recovery. Since we just removed the file we would be searching for the file in the free space. 

Step 8: Now the list of the files in the user directory would be displayed.

From here select the directory in which the file was located. Since we created the file in this very directory we would be selecting. (dot/period) which signifies the current directory.

Step 9: After this, the file recovery procedure would begin.

The above page shows us the number of files that have been recovered for the specific file type. Since we haven’t provided any file format to look for, the program would be looking over all the files that could be found in the directory of the partition. After the process mentioned above is finished a number of folders containing the recovered files would be created having the following name structure:

recup_dir.*

where * is an integer.

After the completion the following folders/directories were created:

The file which was deleted would be within one of these folders. It could be found easily by searching the file name using the find command on the directories. But it is possible that the recovered file may not have the same name as before deletion. But overall, the process of identifying the file within the folder is a trivial one. 

The deleted file was found in the recup_dir.14 directory. And the display of the contents of the file using the cat command confirms that it is the file that was created initially.