Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Are there any tools, methods, incantations to recover recently deleted files on Ubuntu?

If it makes any difference, I want to recover a Keepass 2.x database file. But would be better to have a method/tool that works on any kind of file.

share|improve this question
add comment

9 Answers

TestDisk can sometimes recover recently deleted files.

share|improve this answer
add comment

extundelete is really great if your file system is ext3 or ext4.

Note: extundelete requires you to unmount your drive to work properly (this is a good idea to do ASAP anyway, to avoid potentially overwriting the hopefully-recoverable bytes in the deleted files).

Unmounting the drive on a live system can be tricky... you'll often get the 'device is busy' message. To clear this 'properly' requires shutting down all processes accessing the file system. But... you were likely working in your home directory, and a zillion processes are hooked into your home directory, so good luck with that.

The trick to getting around this is to do a 'lazy' unmount:

$ mount
/dev/sda7 on /home type ext4 (rw)
$ sudo umount -l /home

where:

  • that example is for me prepping my /home mount for use with extundelete. You obviously need to replace /home with your mount of interest
  • I did the mount command first to figure out what device (/dev/sda7) I need to pass to extundelete (output is truncated for brevity)
  • that is a lower case L in the -l option
share|improve this answer
1  
A lazy unmount doesn't really help since the fs remains mounted until all files on it are closed. You just need to shut down the system as soon as you delete the files, and run extundelete from a livecd. –  psusi Jul 7 '11 at 1:52
    
@psusi - It is absolutely untrue to say that it doesn't help!! umount -l prevents any new files from being opened/created and written (web caches and such). However, it does not prevent existing opened files from still being written to (ie: it does not close existing files). You suggest shutting down, but I think a lazy unmount will (most of the time) result in less written files, depending on the partition in question. On that note, it is best is to have extundelete installed already, and if not, make sure to install it to some partition other than the one you are trying to recover! –  Russ Jul 11 '11 at 15:30
    
As long as the fs is still mounted, attempting to access it will result in corruption. That is the reason that extundelete requires you unmount the fs in the first place. The lazy unmount simply fools it into thinking it is not mounted, and therefore, that it is safe to proceed with manipulating the disk, when that is not true. Proceeding with extundelete before the fs is actually dismounted can hose the whole disk. –  psusi Jul 11 '11 at 18:15
    
@psusi - "can hose the whole disk"??! With a read-only operation? I don't get your argument, or what has you so paranoid. extundelete does not "manipulate the disk". The worst possible thing I can imagine happening is that extundelete expects an unmounted/static partitition and if, while reading the journal info, the lazily unmounted disk changes due to processes that had files open, extundelete may get confused and the recovery may fail. "possibly failed recovery" != "hosed disk". If it does fail, shut down, pray shutdown doesn't trash your lost data, and use a livecd as you suggest. –  Russ Jul 12 '11 at 16:55
    
undeleting something involves writing to the disk. There is a reason that the authors of the program tell you to unmount the disk. I'm not pulling that out of thin air. I'm simply pointing out that a lazy unmount only fools the program into thinking it has been unmounted when it really hasn't. –  psusi Jul 12 '11 at 17:12
add comment

I have used foremost to recover damaged hard disk both under NTFS (windows), FAT32 (Flash card from a Nokia phone) and ext3 with great results. Command line only, but quite it's easy, something like this:

sudo foremost -i /dev/sda -o <dir where recovered files will be stored>

It will order the recovered files on folders by file-type. Openoffice docs are recovered as zip files. As you need to execute it as root (in order to direct access the hardware), output files are also owned by root, so you will likely need to change their ownership afterwards.

share|improve this answer
    
This is probably too old question but, how does GIMP files look like after recovery? –  wakeup Oct 3 '13 at 21:04
    
I don't know, I have never tried to recover them. –  Javier Rivera Oct 4 '13 at 6:28
    
@JavierRivera - I do not believe that foremost can recover .xcf files. See the man page it can only deal with these file types: (jpg, gif, png, bmp, avi, exe, mpg, mp4, wav, riff, wmv, mov, pdf, ole, doc, zip, rar, htm, and cpp). –  slm Mar 31 at 0:48
add comment

If using secondary internal HD (suspect the same for external HD) for recovered file import (from main HD, where the files originally were), it’s necessary to make a directory, into which the files will be put in on secondary HD. To do it, you need to have BIOS setting for booting from CD first! 1. Start Live Ubuntu Rescue-Remix CD, give command to boot, then when it boots into terminal, check your HDs by command – Code: sudo fdisk -l

Realize what HD is main, and which is secondary, and what partition to check for files and into which to recover them – linux ext3 or Windows NTFS! Mine was Linux. Have enough room on it! (Then you can try to run Photorec (“sudo photorec”) and hopefully you’ll be able to see all your HDs. I was not that lucky, so I had to make directory and mount sec. HD.)

  1. Make directory for recovered files first, e.g. – media/disk. Give command – Code: sudo mkdir /media/disk

If alright, terminal prompt simply returns.

  1. Must mount secondary HD, or it’ll be invisible, even if “sudo fdisk -l” does show it. Give command for your secondary HD – Code: sudo mount -t ext3 /dev/sdb2 /media/disk

If alright, terminal prompt simply returns.

  1. Run Photorec by command – Code: sudo photorec

Go thru settings, and only choose file types that you want, otherwise you’ll have thousands of files to sift thru!

For more details you may please visit: http:/www..ubuntumanual.org/posts/357/recover-your-deleted-files-in-ubuntu

share|improve this answer
add comment

Try Scalpel

sudo apt-get install scalpel

for more info

man scalpel

share|improve this answer
    
trying it now. I don't quite understand how to add new files to the conf file. Do you have nay source with details? –  Decio Lira Sep 9 '10 at 2:30
1  
I found howtoforge.com/recover-deleted-files-with-scalpel which is better than nothing. Good luck, this ain't no MS-DOS. –  msw Sep 9 '10 at 2:58
    
see also ubuntu.stackexchange.com/questions/2596/… I use a relatively heavy system backup, but have "Back in Time" set up to dup selected directories from /home/msw (including .config which also catches .config/keepassx/* (your locations may vary)) to a spare partition nightly. I've also been using Unix since forever and you usually become pretty careful after the second time you blow away the-really-critical.file ;) –  msw Sep 9 '10 at 3:06
add comment

Autopsy and the Sleuthkit tools are great for recovering deleted files, with a user-friendly UI, as well as being available in the repos.

share|improve this answer
    
good to know. will take a look at them. ;) –  Decio Lira Oct 12 '10 at 19:03
    
I'd upvote it if you would have added some links. –  MadMike Nov 14 '13 at 10:48
add comment

To recover the directory you can use extundelete

  1. Install extundelete

    sudo apt-get install extundelete
    
  2. Command to recover

    sudo extundelete --restore-directory /home/Documents/ /dev/sda1
    

Note: In place of dev/sda1 put your hardisk partition name.

/home/Documents/ is your path to deleted directiory.

share|improve this answer
add comment

Recently I used ext3grep to recover a large SQLite 3 file that was deleted from an ext3 file system.

I had tried many other undelete tools, all which couldn't recover the file (from a dd image of the disk).

In order to use ext3grep, I needed to download and compile the source. Carefully reading http://www.xs4all.nl/~carlo17/howto/undelete_ext3.html from top to bottom in order to understand how the ext3 file system works and how to use the journal to find where deleted files use to be on the disk was also required.

This is not a simple solution, but very, very powerful. If you're prepared to invest a few hours to study the document and compile the program, it's well worth it.

share|improve this answer
    
Thanks, I maybe try that. will this only work with ext3 file systems? What about ext4? –  Decio Lira Sep 23 '10 at 17:28
    
I'm not sure about ext4 but I think ext4 is backward compatible to ext3. I would assume it would work but have never tried. –  Stacey Richards Oct 21 '10 at 10:55
add comment

If you deleted some file by accident but still know some strings which were written in that file you can use:

grep -a -B 25 -A 100 'containing string' /dev/sda1 > result.txt
share|improve this answer
    
what if the file is binary and not text? –  Decio Lira Sep 9 '10 at 12:11
    
Assuming it was text, how can he recover the file with result.txt? I'm not getting it.. –  sergio91pt Jul 2 '11 at 11:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.