Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Possible Duplicate:
How to recover deleted files?

Using Ubuntu 10.10, I have a startup script that automatically removes my 'working directory'. This is a simple folder on my Desktop where I place a bunch of files that I use throughout the day. These are temporary files I need to store just for that one session. In order to keep things clean, my startup script does:

rm -rf /home/user/Desktop/workdir
mkdir /home/user/Desktop/workdir

Works great. Till the moment I had some important files there and forgot to move them before shutting down. A few (2-3) sessions ago this happened and I now realize I need to recover the "workdir" directory. But several new ones have been created and removed in the meantime. What is the best way to recover this - if possible? I read about tools like scalpel but it seems they will scan my whole HD. I know the name of the folder and would like to just look for this workdir folder. What is best?

UPDATE - attempt with Foremost

I have used foremost to try to recover my files. I used:

sudo foremost -a -t doc -i /dev/sda1 -o/home/user/Desktop/foremost

Apparently, I have been removing many documents. So many files were recovered that I had to remove other files on the fly in order to not fill up my hard drive. Over 30GB of XLS/PPT/OLE(?)/Word files were restored. I had to break off the restore process. For Word documents, I have now over 7GB in 3,050 files. How to I get to the right file? They are all numbered, and the date of modification is today for all files.

Also, I need to restore 3 other JPG files as well. This might become an ever larger set of files. How can I only recover what was removed in the last week? Or by using the original filename, is that possible?

share|improve this question

marked as duplicate by Tachyons, Tom Brossman, Eric Carvalho, Alvar, hhlp Jan 1 '13 at 0:33

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
I realize it's a bit late to mention it, but for scripts like this I like to use trash-cli instead of rm. –  ændrük Feb 9 '11 at 1:38
1  
If this is a priority situation, get a huge external drive and restore to that and wade through it all. I am curious if the functionality you want exists in an open source tool. –  djeikyb Feb 9 '11 at 13:13

3 Answers 3

up vote 1 down vote accepted

Give a chance to Foremost

It's an easy-to-use forensics program which may be helpful for your case.

Direct download link to foremost:

Will download a compressed file, inside of which you can find the README file with instructions.

After compiling and installing a description of the command line arguments can be found in the man page.

To view it:

man foremost

Good luck!

share|improve this answer
2  
Just a note. You can install with: 'sudo apt-get install foremost' in Terminal. –  Ads20000 Apr 23 '13 at 7:55

Testdisk works great. You could boot from a LiveCD, point testdisk at your drive, navigate to where the deleted files were, and copy them off.

share|improve this answer
2  
Just to lower expectations: trying to recover a whole deleted home directory on an ext4 partition was impossible. TestDisk showed most of the files, but they were already garbage (without writing to the disk after the "accident"). –  htorque Feb 8 '11 at 19:16
    
Use Foremost, you can give up even the file type you want to recover. –  Ilias el Matani Feb 9 '11 at 13:52

I've uploaded a howto video of Foremost to Youtube:

http://www.youtube.com/watch?v=P767rumEIKw

Please enter in terminal:

cat /proc/partitions

Then you can see which partition you need to use with foremost.

Your command will be:

sudo foremost -a -t FILE-TYPE -i /dev/sdb1 -o /home/map/to/recover/files

You should replace sdb1 to your partition.

Keep me informed.

share|improve this answer
    
Thanks, I've tried Foremost (see my original post), but do not know how to proceed...? –  user6019 Feb 9 '11 at 12:15
    
"Or by using the original filename, is that possible?" That's not possible with ForeMost. see: foremost.sourceforge.net/foremost.html –  Ilias el Matani Feb 9 '11 at 15:05