10

I had accidentally deleted a few files from an Ubuntu Desktop. Now I need to recover only the perl files which had been sitting in /home/user directory. How can this be done? I am able to boot using a live Ubuntu USB. Please explain.

  • Using photorec is probably not a viable solution, unless you have a separate home partition; running it on the root partition will have the effect of recovering thousands of files without any metadata (i.e. with a filname generated by photorec on-the-fly, not useful to understand which files are the files you're looking for; at the very least you'll need to use grep -l '#!/usr/bin/perl' or variations and hope that not too many perl scripts exist / have existed in your system). Using testdisk you should be able to recover just the deleted folder / files by browsing the filesystem. – kos Sep 20 '15 at 11:55
  • I suggest you to shut down the system immediately, to avoid the files being overwritten, and to boot a Live DVD / USB and do things from there: here's an answer I gave some time ago about using testdisk; you should be able to adapt it and use it to recover the files; if no avail, you should try karel's solution, but you'll need to go through all the files somehow – kos Sep 20 '15 at 12:00
15

Before you start:

  • It's always a good idea to work from a copy of your deleted data, so copy your entire disk before you begin
  • If you cannot, boot from a Live-USB/DVD before you begin.
  • If you cannot, know that by each and every single byte you write to your disk right now, one byte of one of your deleted files will be overwritten! (i.e. by installing PhotoRec and TestDisk, some deleted files will be overwritten by the applications that you're going to install if you continue!).

What are the main differences between TestDisk and PhotoRec?

TestDisk is a lot more efficient than PhotoRec. The problem with TestDisk is that it doesn't always recover all deleted files. If you accidentally reformat a partition, TestDisk can recover thousands of files without missing a single file, but if you deleted a file by sending it to the Trash and then emptying the Trash, TestDisk can't always recover it.

So use TestDisk first, and if you recovered all of the deleted files with TestDisk, then you're done. If you recovered most of the deleted files with TestDisk, you can decide whether you're done or not. If you're not done after running TestDisk, you can try recovering the deleted files using PhotoRec.

PhotoRec can selectively recover files based on their filetype(s), but PhotoRec / TestDisk can't selectively scan an individual directory for lost files unless you had mounted a whole hard drive partition as this directory. In some cases, the filename is stored in the file itself. PhotoRec tries to recover the filename in this case, but most of the time PhotoRec can't recover the filenames.


Recover files based on filetype using PhotoRec

  1. Install TestDisk from the Ubuntu Software Center.

    sudo apt-get install testdisk
    
  2. Launch PhotoRec.

    Open a terminal and launch photorec (as root).

    sudo photorec
    
  3. Select hard disk.

  4. Select partition type.

    If your hard disk has Linux partitions, then select [Intel].

  5. Select filetype option.

    Move to [File Opt] and press Enter. Here you can disable all file types by pressing s. Use space to toggle the check button. Select filetype(s) to recover. For Perl you can select pl for Perl script or pm for Perl module.

  6. Select options.

    Photorec also has a list of different options. Under normal circumstances you don’t need to modify them.

  7. Select partition.

    Move the selector up or down to the partition from which you have removed the file(s). Then select [Search] and press Enter.

  8. Select filesystem type.

    If you are using Linux, it's going to be ext2/ext3/ext4, so the default selection is ext2/ext3. Otherwise if you are recovering files from a partition formatted as FAT or NTFS select Other.

  9. Select space for analysis.

    Select Free if you didn’t write to that partition after removing the particular file, otherwise select Whole.

  10. Select a directory for the recovered files

    Select the path where the recovered files will be stored. Then press Y.

Photorec will show how many files it has recovered.

Source: revised from How To Recover Deleted Files in Linux Using Photorec

  • I'd first try testdisk and then photorec: photorec will recover all the text files in the selected partition, with no metadata (hence no filenames in the recovered files) and possibly thousands of files recovered. If the filesystem entries haven't been overwritten yet with testdisk one could recover just the single deleted folder / deleted files. Also I'd strongly suggest to not do this while booting from the hard drive containing the deleted files, but to shut the system down immediately and to do this from a Live DVD / USB. – kos Sep 20 '15 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.