Recover deleted files in linux with Photorec

Written by Mel Kham on October 12, 2009. Posted in Linux tutorials

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (thus, its ‘Photo Recovery’ name) from digital camera memory. PhotoRec ignores the filesystem and goes after the underlying data, so it will still work even if your media’s filesystem has been severely damaged or re-formatted.

PhotoRec runs under

DOS/Win9x
Windows NT 4/2000/XP/2003/Vista
Linux
FreeBSD, NetBSD, OpenBSD
Sun Solaris
Mac OS X

and can be compiled on almost every Unix system.

1- Photorec installation (Linux) :

To install Photorec on ubuntu simply type :

sudo apt-get install testdisk

For fedora/CetOS :

yum install testdisk

For other linux distribution please visit the download page of Photorec

2- Recover deleted file usingPhotorec :

For example, Let`s assume that i deleted accidently a photo( unixmen.jpg) from a partition with filesystem NTFS ,to recover the deleted photo i will have to follow the steps bellow as described on the screenshots.

First, open the terminal and type :

sudo photorec

Shoose your hard disk

Choose intel and type enter

Choose the partition from where you deleted the file, you can set File Opt to choose the file extension you want to recover (see next screenshot)

choose type of deleted file extension, in my case is a photo with extension .jpg and then type enter (you can select extension by using space in your keyboard)

Now choose the type of the filesystem, in my case is a NTFS (shared partition) so i will choose Other.

You will got a message if you want to save the recovred file on your home directory , in my case is /home/zinovsky type yes and then enter

Now you have to select [free] if you diden`t write the the partition after deleting the file, otherwise choose [whole ]

Now photorec start to recover, the operation will take some time so be patient.

When the program will finish recovering, go and check the folder where the file will be recovred, your document or photo will be there :).

Important (From the website) :

For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from. Important: As soon as a pic or file is accidentally deleted, or you discover any missing, do NOT save any more pics or files to that memory device or hard disk drive; otherwise you may overwrite your lost data. This means that even using PhotoRec, you must not choose to write the recovered files to the same partition they were stored on.

Links :

http://www.wikipedia.com
http://www.cgsecurity.org/wiki/PhotoRec

For questions please refer to our Q/A forum at : http://ask.unixmen.com

Linux

Photorec

Recover Deleted Files

Testdisk

7 Comment(s)

Kuabris Defrabax

About a month ago, I accidentally deleted my vacation photo’s from both my camera and my hard disk. My girlfriend almost strangled me, but the next day, I found Photorec in the Ubuntu repositories… :idea: :)
- zinovsky
  
  Is a nice software , i test it and is working like a sharme :), is realy a good one for recovering files and fotos
tom

Yea, but does it work on ext3 or XFS? How many Linux users don’t use journaling filesystems these days?
Grant Wagner

During our vacation, my wife was cleaning out our camera when she accidently deleted all of the photos from the past two days, thinking they were already copied. Luckily I was able to use this program to recover almost all of them.

I even got a “Saved by Linux” image at the end of our photo album thanks to it.
http://mnemonikk.org/2009/04/26/recovering-data-from-a-broken-ntfs-hard-drive/ Anselm Helbig

I had to recover data from an NTFS filesystem on a friend’s broken USB HD drive a while ago. I was able to recover all relevant data with The Sleuth Kit, after trying PhotoRec and foremost. But YMMV, PhotoRec will probably still work on volumes that even Sleuth Kit can not make sense of anymore.

I also blogged about it here: [url]http://mnemonikk.org/2009/04/26/recovering-data-from-a-broken-ntfs-hard-drive/[/url].
http://www.denizyildirim.net Deniz

i want to recover my old website, The extension of these files are php… but i didn’t see php extension in picture #5. In photorec official web site write that the photorec can recognise php files header… but i didnt saw in the program… Please help me… It is kind of urgent…:(

Thank you, Deniz
matu

look for a txt. It can recognize php files.