15

Possible Duplicate:
How to recover deleted files?

Using Ubuntu 10.10, I have a startup script that automatically removes my 'working directory'. This is a simple folder on my Desktop where I place a bunch of files that I use throughout the day. These are temporary files I need to store just for that one session. In order to keep things clean, my startup script does:

rm -rf /home/user/Desktop/workdir
mkdir /home/user/Desktop/workdir

Works great. Till the moment I had some important files there and forgot to move them before shutting down. A few (2-3) sessions ago this happened and I now realize I need to recover the "workdir" directory. But several new ones have been created and removed in the meantime. What is the best way to recover this - if possible? I read about tools like scalpel but it seems they will scan my whole HD. I know the name of the folder and would like to just look for this workdir folder. What is best?

UPDATE - attempt with Foremost

I have used foremost to try to recover my files. I used:

sudo foremost -a -t doc -i /dev/sda1 -o/home/user/Desktop/foremost

Apparently, I have been removing many documents. So many files were recovered that I had to remove other files on the fly in order to not fill up my hard drive. Over 30GB of XLS/PPT/OLE(?)/Word files were restored. I had to break off the restore process. For Word documents, I have now over 7GB in 3,050 files. How to I get to the right file? They are all numbered, and the date of modification is today for all files.

Also, I need to restore 3 other JPG files as well. This might become an ever larger set of files. How can I only recover what was removed in the last week? Or by using the original filename, is that possible?

2
  • 1
    I realize it's a bit late to mention it, but for scripts like this I like to use trash-cli instead of rm.
    – ændrük
    Feb 9, 2011 at 1:38
  • 1
    If this is a priority situation, get a huge external drive and restore to that and wade through it all. I am curious if the functionality you want exists in an open source tool.
    – djeikyb
    Feb 9, 2011 at 13:13

3 Answers 3

10

Testdisk works great. You could boot from a LiveCD, point testdisk at your drive, navigate to where the deleted files were, and copy them off.

2
  • 2
    Just to lower expectations: trying to recover a whole deleted home directory on an ext4 partition was impossible. TestDisk showed most of the files, but they were already garbage (without writing to the disk after the "accident").
    – htorque
    Feb 8, 2011 at 19:16
  • Use Foremost, you can give up even the file type you want to recover.
    – Ilias
    Feb 9, 2011 at 13:52
6

Give a chance to Foremost (here sourceforge project, last v1.5.7 from 2010). It's an easy-to-use forensics program which may be helpful for your case:

sudo apt-get install foremost

Alternative: In this download link you will get a compressed file, inside of which you can find the README file with instructions.

After compiling and installing a description of the command line arguments can be found in the man page:

man foremost
1
  • 4
    Just a note. You can install with: 'sudo apt-get install foremost' in Terminal.
    – Ads20000
    Apr 23, 2013 at 7:55
3

I've uploaded a howto video of Foremost to Youtube:

http://www.youtube.com/watch?v=P767rumEIKw

Please enter in terminal:

cat /proc/partitions

Then you can see which partition you need to use with foremost.

Your command will be:

sudo foremost -a -t FILE-TYPE -i /dev/sdb1 -o /home/map/to/recover/files

You should replace sdb1 to your partition.

Keep me informed.

2
  • Thanks, I've tried Foremost (see my original post), but do not know how to proceed...?
    – user6019
    Feb 9, 2011 at 12:15
  • "Or by using the original filename, is that possible?" That's not possible with ForeMost. see: foremost.sourceforge.net/foremost.html
    – Ilias
    Feb 9, 2011 at 15:05