Sometimes files and important data are accidentally deleted. There are many reasons this may happen; overlooking what’s in the trash can, pressing the wrong button, etc. It happens. In situations like this, it is important to know how to get these files back. Since Linux is used in part by people that manage a lot of data, there are no shortages when it comes to finding programs that help recover lost data on Linux.
In this tutorial, we’ll be focusing on a tool known as Testdisk. It’s a program that specializes in recovering data from many different places. It scans the cylinders and other parts of the hard drive to check for deleted data. The best part? Testdisk can find deleted data from previously deleted partitions, create backups, and more.
Testdisk is a very popular program, especially with those that manage a lot of data and multiple hard drives on Linux. As a result, it is possible to install it from any Linux distribution’s collection of programs. To install it, either open the Gnome App Store (if your version of Linux has it), search for “testdisk”, and install it. Alternatively, install it by entering the following command.
sudo pacman -S testdisk
sudo apt install testdisk
sudo dnf install testdisk -y
sudo zypper install testdisk
sudo apt-get install testdisk
Don’t have Gnome Software, but your version of Linux is not listed above? Search for “testdisk” using your package manager. Then, install it the normal way you install programs. If not, go to pkgs.org, search for testdisk, download the package, and install it that way. There are many different ways to install this program.
Testdisk is a text-based program that only will run in the terminal. This doesn’t mean it’s command-line based. There are no long text commands to remember. Instead, it uses a “text-gui” type setup. To open testdisk, get a root shell first, by using this command:
Then enter the command “
testdisk” to start it.
When the program starts up, there are three options present. The options are “Create Log”, “Append” and “No Log”. Select the “Create Log” option. This will allow testdisk to record every action that takes place. This way, if you make a mistake, you’ll be able to go through the log and read what went wrong. Select the “No Log” option if you do not care about keeping a record at all. Either option is okay, but logging is recommended.
With the option selected, testdisk will find any and all hard drives currently connected to the Linux PC. This includes other types of data storage like flash drives, SD cards, etc. Select the hard drive you wish to recover the data from by using the up and down arrow keys to highlight. Press enter to select the hard drive.
From here, testdisk asks the user to specify what type of partition table is in use. Not sure what this means? If your Linux distribution uses UEFI (you’ll know if it does by looking inside of the BIOS and boot settings), select EFI GPT in the list. Use MS-DOS MBR as a partition layout? Select that with the menu. Not sure? Don’t worry, as testdisk can usually tell you the right answer, by auto-detecting it.
On the next page, there are several options. The only one that matters is the “Analyze” option. Select it, and testdisk will look deep into the hard drive. It will find deleted data on partitions that exist on the drive, and ones that have already been deleted.
When testdisk finishes scanning the entire hard drive, it shows a list of data that the user can recover. Select any file in this list, then press c on the keyboard. This will copy the deleted data into your home directory. Want to hide these files and make them unrecoverable? Press h on the keyboard instead. This will hide them.
Along with recovering files removed from the system, users can recover entire partitions too. First, select “Create” to start a log. Then select the partition layout when testdisk asks for it.
Next, select the drive in the list, then “Advanced” on the page in testdisk with all of the different options to choose from.
Highlight a deleted partition in testdisk. You’ll know it’s deleted because the option “undelete” is there. Select it, and testdisk will re-organize the hard drive, and make room to undelete the partition.
Note: It is also possible to recover the deleted hard drive partition directly to a burnable image.
Select “Image Creation” to make a disk image (which can be burned to the hard drive later with Gnome Disks) of the deleted partition. For those worried about messing up the hard drive by restoring partitions, this may be a good choice.
As we put more and more of ourselves on our computers, even the most prepared Linux user needs to know how to recover deleted files. Obviously, relying only on a program that can “undelete” files isn’t a replacement for good file backup procedures, but when you’re in a pinch it can get you out of a tight spot.