How to recover deleted files in ubuntu using live usb? [based on filetype]

Question

I had accidentally deleted a few files from an Ubuntu Desktop. Now I need to recover only the perl files which had been sitting in /home/user directory. How can this be done? I am able to boot using a live Ubuntu USB. Please explain.

Answer 1

testdisk is a lot more efficient than photorec. The problem with testdisk is that it doesn't always recover all deleted files. If you accidentally reformat a partition, testdisk can recover thousands of files without missing a single file, but if you deleted a file by sending it to the Trash and then emptying the Trash, testdisk can't always recover it.

So use testdisk first, and if you recovered all of the deleted files with testdisk, then you're done. If you recovered most of the deleted files with testdisk, you can decide whether you're done or not. If you're not done after running testdisk, you can try recovering the deleted files using photorec.

PhotoRec can selectively recover files based on their filetype(s), but photorec/testdisk can't selectively scan an individual directory for lost files unless you had mounted a whole hard drive partition as this directory. In some cases, the filename is stored in the file itself. PhotoRec tries to recover the filename in this case, but most of the time PhotoRec can't recover the filenames.

---

Recover files based on filetype using PhotoRec

1. Install testdisk from the Ubuntu Software Center.

   sudo apt-get install testdisk
   

2. Launch PhotoRec.

   Open a terminal and launch photorec (as root).

   sudo photorec
   

3. Select hard disk.

4. Select partition type.

   If your hard disk has Linux partitions, then select [Intel].

5. Select filetype option.

   Move to [File Opt] and press Enter. Here you can disable all file types by pressing s. Use space to toggle the check button. Select filetype(s) to recover. For Perl you can select pl for Perl script or pm for Perl module.

6. Select options.

   Photorec also has a list of different options. Under normal circumstances you don’t need to modify them.

7. Select partition.

   Move the selector up or down to the partition from which you have removed the file(s). Then select [Search] and press Enter.

8. Select filesystem type.

   If you are using Linux, it's going to be ext2/ext3/ext4, so the default selection is ext2/ext3. Otherwise if you are recovering files from a partition formatted as FAT or NTFS select Other.

9. Select space for analysis.

   Select Free if you didn’t write to that partition after removing the particular file, otherwise select Whole.

10. Select a directory for the recovered files

    Select the path where the recovered files will be stored. Then press Y.

Photorec will show how many files it has recovered.

_{Source: revised from How To Recover Deleted Files in Linux Using Photorec}