Deleted File Recovery Ubuntu: How to Undelete
Deleted file recovery on Ubuntu is possible in many cases, but the success depends on the filesystem and how quickly you act. This article explains the main recovery methods, what to do immediately after deletion, and how to avoid common mistakes.
Why Deleted Files Can Often Be Recovered
When you delete a file in Ubuntu (either with rm or from the file manager), the data is not immediately erased from the disk. The filesystem simply marks the space as available for reuse. Until that space is overwritten by new data, the original file content remains physically on the drive. This is why recovery tools can scan the raw disk and reconstruct the file. The key is to stop using the drive as soon as possible to avoid overwriting the deleted data.
Immediate Steps to Take After Deletion
The most important rule: do not write anything new to the drive. This includes saving files, installing software, or even browsing the web if your home directory is on the same partition. If the deleted file was on an external drive or a separate partition, you can unmount it to prevent any further writes. If it was on your root or home partition, the safest approach is to boot from a live USB and run recovery tools from there, so the system does not write to the disk while you are working.
Recovery Tools for Ubuntu
Several command-line tools are available in the Ubuntu repositories. The most common are:
- extundelete – works on ext3 and ext4 filesystems, can restore files and directories.
- testdisk – primarily for recovering lost partitions, but can also undelete files on some filesystems.
- photorec – focuses on recovering file content by signature, ignoring the filesystem structure; good for documents and media.
- foremost – similar to photorec, uses file headers to recover data.
- scalpel – another file-carving tool, less user-friendly but very fast.
For ext4 filesystems, extundelete is often the first choice because it can restore the original file names and directory structure. However, it does not work on btrfs, xfs, or NTFS. Testdisk and photorec are more universal.
How to Use extundelete (ext4 Example)
First, install it (if you are on a live system, you may need to add the universe repository). Then run:
- Unmount the partition if it is not your root:
sudo umount /dev/sda1 - Run extundelete with the partition and the file or directory path:
sudo extundelete /dev/sda1 --restore-file /home/user/document.pdf - To restore a whole directory:
sudo extundelete /dev/sda1 --restore-directory /home/user/ - To see all recently deleted files:
sudo extundelete /dev/sda1 --restore-all
The restored files are placed in a folder named RECOVERED_FILES in the current directory. Note that extundelete relies on the filesystem journal, so it works best if the deletion happened recently and the journal is intact.
Using TestDisk and PhotoRec
TestDisk is excellent for recovering lost partitions or fixing boot sectors. For file recovery, you can use it to undelete files on FAT, NTFS, and ext2/3/4. PhotoRec is a companion tool that scans the raw disk for known file signatures. It works even if the filesystem is severely damaged, but it does not preserve file names – it saves files as f1234567.ext in a folder you specify. This is acceptable if you just need the content, not the original name.
Choosing the Right Tool
Your choice depends on the filesystem and the situation:
- ext3/ext4, recent deletion, file names matter: use extundelete.
- FAT/NTFS (USB drives, Windows partitions): use testdisk or photorec.
- Filesystem corrupted or unknown: use photorec or foremost.
- Recovering a whole partition: use testdisk.
For btrfs, there is no dedicated undelete tool in the standard repos; you might need to use btrfs restore (which is part of btrfs-progs) to extract files from a snapshot or the filesystem image.
Common Mistakes and Misconceptions
One common mistake is installing recovery tools on the same drive where the deleted file resides. This can overwrite the very data you are trying to recover. Always install to a different drive or use a live USB. Another misconception is that emptying the Trash permanently deletes the file. It does not; it just marks the space as free. Also, SSDs with TRIM enabled may permanently erase deleted data quickly, so recovery on an SSD is much less likely. Finally, do not attempt recovery on a drive that is failing – you may cause further damage. In that case, clone the drive first using ddrescue and run recovery on the clone.
Frequently Asked Questions
Can I recover a file deleted with rm?
Yes, if the filesystem is ext3/ext4 and you act quickly. The file content remains until overwritten. Use extundelete or photorec. The longer you wait and the more you write to the disk, the lower the chance.
Does the Trash make recovery easier?
Yes, files in the Trash are not actually deleted – they are moved to a hidden folder (~/.local/share/Trash). You can simply restore them from the file manager. Only when you empty the Trash does the space become free.
Why can’t I recover files from my SSD?
SSDs use TRIM, which tells the drive to erase unused blocks immediately. Once TRIM runs, the data is gone. Recovery on an SSD is often impossible. If you have an external SSD, unplug it immediately after deletion.
Can I recover files from a crashed or corrupted filesystem?
Yes, using photorec or foremost, which scan the raw disk for file signatures. They do not rely on the filesystem structure, so they can work even if the filesystem is damaged. However, you will lose file names and folder structure.
Is there a GUI tool for file recovery on Ubuntu?
Yes, there are graphical frontends like extundelete-gui (not official) and testdisk has a text-based interface. You can also use R-Linux (free for ext2/3/4) but it is not open-source. Most users find the command-line tools sufficient.
What should I do if the recovery tool says the file is unrecoverable?
If the file content has been overwritten, no tool can recover it. You can try a different tool, but the result will likely be the same. The best prevention is regular backups. Consider using a versioned backup system like rsnapshot or a cloud service.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.