Recover deleted files in linux with Photorec

PhotoRec runs under

• DOS/Win9x
• Windows NT 4/2000/XP/2003/Vista
• Linux
• FreeBSD, NetBSD, OpenBSD
• Sun Solaris
• Mac OS X

and can be compiled on almost every Unix system.

1- Photorec installation (Linux) :

To install Photorec on ubuntu simply type :

sudo apt-get install testdisk

For fedora/CetOS :

yum install testdisk

For other linux distribution please visit the download page of Photorec

2- Recover deleted file usingPhotorec :

For example, Let`s assume that i deleted accidently a photo( unixmen.jpg) from a partition with filesystem NTFS ,to recover the deleted photo i will have to follow the steps bellow as described on the screenshots.

First, open the terminal and type :

sudo photorec

Shoose your hard disk

Choose intel and type enter

Choose the partition from where you deleted the file, you can set File Opt to choose the file extension you want to recover (see next screenshot)

choose type of deleted file extension, in my case is a photo with extension .jpg and then type enter (you can select extension by using space in your keyboard)

Now choose the type of the filesystem, in my case is a NTFS (shared partition) so i will choose Other.

You will got a message if you want to save the recovred file on your home directory , in my case is /home/zinovsky type yes and then enter

Now you have to select [free] if you diden`t write the the partition after deleting the file, otherwise choose [whole ]

Now photorec start to recover, the operation will take some time so be patient.

When the program will finish recovering, go and check the folder where the file will be recovred, your document or photo will be there :).

Important (From the website) :

For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from. Important: As soon as a pic or file is accidentally deleted, or you discover any missing, do NOT save any more pics or files to that memory device or hard disk drive; otherwise you may overwrite your lost data. This means that even using PhotoRec, you must not choose to write the recovered files to the same partition they were stored on.

• http://www.wikipedia.com
• http://www.cgsecurity.org/wiki/PhotoRec