Data Recovery in Linux - How To Recover Your Data after Drive FailuresCheck out this guide on basic Data Recovery in Linux to get back files from corrupt SD cards or that you may have deleted in error.
This article is part of a series of articles. Please use the links below to navigate between the articles.
- How to Download and Installing Linux Step by Step For Beginners
- Essential Guide to Working with Files in Linux
- Understanding Linux File Permissions and Permission Calculator
- How to Archive, Compress and Extract Files in Linux
- Linux Piping and Redirection Explained
- Hardlinks and Softlinks in Linux Explained With Examples
- How to Create and Use Bash Scripts in Linux
- Data Recovery in Linux - How To Recover Your Data after Drive Failures
- Apache Web Server Administration Cheat Sheet for Linux
- Essential MariaDB and MySql Administration Tips on Linux
- How to Switching from Windows to Linux - A Complete Guide
I'm too busy doing six things simultaneously, and during a slight loss of concentration, I've deleted the files that I need! What do I do? How do I get them back? How do I undelete files in Linux?
The first thing to do is "Don't Panic!" You can easily recover lost files and perform basic data recovery in Linux using these instructions.
Most, if not all, filesystems will only delete the reference to the file from the partition table. This means the data is still available, but the link has gone, making it possible to undelete files easily. You mustn't write any more information to the drive the files were on, as the new data could overwrite the file you want to recover, making the data recovery process much more difficult.
If the files undelete are on your boot drive, you should remove the hard drive and access it from another PC. If it isn't possible to do this, you should be careful and not install software or download any files. Try to get a data recovery or Live CD and boot from that instead.
Fortunately, the files I deleted this time were on a secondary partition, not the boot partition. Rather than remove the drive, I was able to remount it read-only.
sudo mount -o remount,ro /mystorage/
The Linux partition is now mounted read-only, so the data should be "safe".
Next, create a directory on another drive to hold the recovered files.
sudo mkdir /mystorage2/recovery
cd /mystorage2/recovery I'm going to be using ext undelete for this, as the files were on an EXT4 filesystem. If ext undelete is not installed, you can (under Ubuntu) run the following command to install it. Other distributions may have slightly different commands.
sudo apt-get install extundelete
Once installed, you can run the command to recover all files to the current directory.
sudo extundelete /dev/dm-4 --restore-all Where /dev/dm-4 is the partition device.
After about 5 minutes, but depending on the size and quantity of data, any files that can be recovered will be restored to the local path. You can now remount the filesystem read-write and save the files back to their original directory.
Slap yourself on the wrist, and don't do it again!
Update: If you are using Samba shares and accidentally delete a file, you may be interested in enabling a Samba module which adds Recycle Bin functionality for Samba Shares rather than deleting them.
