If you are using Windows, there are many 3rd party tools that can help you recover your files easily. But if you are using Ubuntu, then it can be quite a huge problem. But worry not, since now you can recover your files in Ubuntu too.
Scalpel is one of the best command line tool to recover deleted files in Ubuntu Linux. It can recover almost all types of files. It visits data blocks of files sequentially and identifies deleted files and recovers them instantly. You can install it by running following command in your terminal.
apt-get install scalpel
Once installation is complete, you can start to recover your deleted data by using a simple command. Run the following command in terminal to recover your data.
scalpel /dev/sda1 -o output
where ‘output’ is the name of directory in which scalpel places the recovered files. You can specify any name to this directory, just make sure that this directory should not exist in your system because Scalpel create directory itself. Check the following snapshot to get an overview of how Scalpel searches deleted file.
The time taken by scalpel to recover files depends upon the total disk space and the amount of deleted data in your machine. Further you can check logs of recovery process by viewing audit.txt file in output directory. Enjoy!
Share this article!
19 Comments
I got an error when I ran the command:
ERROR: The configuration file didn’t specify any file types to carve.
(If you’re using the default configuration file, you’ll have to
uncomment some of the file types.)
I had to edit the config file to get it to work:
sudo gedit /etc/scalpel/scalpel.conf
when you type the command to install scalpel, you should type:: sudo apt-get install scalpel
How to retrieve from the output file really stuck in there
How to retrieve from the output file really stuck in there
How to retrieve from the output file really stuck in there
I got an error when I ran the command:
ERROR: The configuration file didn't specify any file types to carve.
(If you're using the default configuration file, you'll have to
uncomment some of the file types.)
how to solve this dude ?
read line 4… uncomment file types from /etc/scalpel/scalpel.conf using something like gedit / nano
delete # <<<<<<
suppose that i just wanna to recover one file that i just deleted by error… how suppose i do that?
I need to recover over 400GB of files that I placed on a hard drive that I use as a back up drive.its a long story that happened 4 hours ago. but I too am stuck with this error:
“ERROR: The configuration file didn’t specify any file types to carve.
(If you’re using the default configuration file, you’ll have to
uncomment some of the file types.)”
please help, Yes I am a newbie. if there is need to elaborate what I did please let me know,I need those files…
I am getting this error while trying to run scalpel
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
to maintain forensic soundness, this is not allowed.
Aborting.
Please help.
The default directory is in your home folder. If you have run the program once then there will be a log file in this folder. You must specify a different folder or delete the contents of the specified folder.
Hello, good afternoon.
I’m still getting trouble with scalpel. First thing:
1. The destination directory is empty, although scalpel informs me that it has carved 397 files
2. At the config file, there’s no mention to open documento format documents or rtf. How can I tell scalpel to carve this ones too?
Thanks a lot
Hi guys.
I’m getting the following message:
Written by Golden G. Richard III, based on Foremost 0.69.
ERROR: You have attempted to use a non-empty output directory. In order
to maintain forensic soundness, this is not allowed.
Aborting.
and when I check my home folder I do not see the output folder.
I was quite hopeful for this, but it turns out to be FUCKING USELESS
partly because of the lazy, idiosyncratic documentation, with undefined terms & silly mistakes,
partly because of the assumption that I would know all sorts of things I really could not be expected to know, including how to set the parameters you don’t explain,
the lazy assumption that I would be working in Sudo,
and in the right directory (if I knew how to set a directory)
(hey, you’re talking to non-tech newbies here,
WHO JUST WANT TO RECOVER THEIR DAMNED FILES,
not to technical geniuses, who if they were technical geniuses, would not need this anyway.)
then when I get past all that, it crashes with a ‘run out of memory’ thing, WHAT???
at about 1.7% done.
So, thanks for trying, COULD DO BETTER though.
Now that I’ve calmed down and got past that (wanker!)
here’s what I need:
I was working with GEDit (another heap of crap, that), and it lost a draft piece of writing I had done (because it, or I, got confused when I tried to re-name it. Unbelievable.)
These seem to be suffix-less files, in this case initially on my (Mint) desktop, a good page of prose.
Can I limit the search to the desktop? To GEDit-type files?
So, I wonder if you could tell me in plain English, without assumptions about my (poor)
inside knowledge of Linux, exactly how I might recover my lost draft (without incurring some odd undocumented memory error).
Then perhaps do some decent documentation so I don’t have to be fucked around next time I or anyone else needs to use you no-doubt excellent utility
It is, after all, my time and patience that is wasted.
ANd, meantime, perhaps help my poor fellow sufferers above with what they want to do in the real world.
….Oh, for Christ’s sake, does it have to be like this? I wasn’t expecting to go into the flames….
that was, by the way:
[sudo] password for mint:
Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.
Opening target “/dev/sda1″
Image file pass 1/2.
/dev/sda1: 2.0% | | 250.0 MB 27:09 ETA** MEMORY ALLOCATION FAILURE **
ERROR: Memory exhausted at line 286 in file dig.c. Scalpel was
allocating memory for header array when this condition occurred.
Scalpel will abort.
and if it did anything at all, it left the recovery file locked, apparently empty.
So far, this seems to be working fine for me. I’m about 1/2 way through the first pass, and no errors coming up. So, to recap the recommendations of others, here’s how to make scalpel work with very little wailing or gnashing of teeth:
When using this is to uncomment (remove the # in front of) the file types in the config file. To do that, open a terminal and run gksudo gedit /etc/scalpel/scalpel.conf. Then, save the changes and return to the terminal.
To download the scalpel program, remember to add sudo to the command when you type it in to your terminal (sudo apt-get install scalpel).
To run the scalpel command correctly, you must again add sudo to it (sudo scalpel /dev/sda1 -o output). Remember, sda1 is the default name for your computer’s hard drive, so if you have a dual drive setup, or an external drive, verify the correct device name by opening the System Monitor and checking the File Systems tab.
If you’ve previously run scalpel, change “output” to something else, or clean out the contents of the output file before you start the process. If you don’t, you will get an error message regarding trying to work with a “non-empty” directory.
I wrote a simple script that executes the scalpel command. All you need to do is put the file in your bin folder, and create a desktop shortcut for it. If you’d like the script, drop me a PM on the Ubuntu Forum. My name there is tacantara.