It happens unfortunately occasionally by careless action: you delete a directory or a file, although it actually not had intended this. This article explains how you can recover deleted files and what you can do preventive, so that no more happens. Also describes how you can recover data from damaged partitions.

Prevent

Delete

Note When you delete the following:

• Check which files to delete
• move to delete only to the trash
• before you empty the Recycle Bin it once again look at

Backup copies

Create regular backups, is no longer difficult. There are a variety of programs that create images manually or automatically.

Save data

Attention!

First of all, the partition on which the deleted files were should be unmounted immediately (for example, using the key combination ALT + print + U cut off which immediately all write permissions). Any subsequent write access could make the files permanently unrecoverable, this applies also to the subsequent installation of the below data recovery programs.

The concerned partition from then on only with Reader rights should be mounted for data recovery. This is not possible (because is also the system on the same partition) can be used on a live system.

Of course, there are not just the here declared programs. Only programs along with a guide are presented here. Other programs can be found on the pages mentioned links.

ext2

Unmount file system

To have tools of access to the appropriate file system, you must unmount first this.

Method 1: debugfs

The program is with the package

• e2fsprogs

installed by default.

Start

Start the program in the Terminal:

sudo/sbin/debugfs

Navigate

Switch using the following command in the drive:

open / dev/hda3

hda3 replace with the drive on which data should be saved.

View files

First you should display all deleted files using the following command:

lsdel

The program uses the following display:

Now you can search for the file to save, by one user ID, file size and termination date (if known) used.

Save deleted file

Now you can save the file with the following command:

dump < [inode number] > [destination-file]

Example:

dump < 4711 >/tmp/recovered

You can watch the created file in an editor then.

Exit program

Quit

Save multiple data

Are deleted accidentally not only one but several files have been, it is of course cumbersome each time run the dump command. Still quite comfortably reach the deleted files can be taken similar to, as described above for a single file.

Instead the list of deleted files in debugfs, they are output to a text file. To enter the following command in the console:

sudo/sbin/debugfs-R lsdel/dev/hda3 > ~/deletedfiles.txt

hda3 replace with the drive on which data should be saved. lsdel lists all the data that have been deleted on the media. The parameter-R ensures that the command lsdel to debugfs is passed (you can enter also the command directly in debugfs). > the list, are held in debugfs, out in the text file "deletedfiles.txt" in the home directory. This list is modified (as root) with an editor. The list looks something like this:

To delete the first and last row. There are inodes that you would like to have restored to just delete the whole line. Now you should save the customized list.

Creates a folder where the recovered data will be collected.

mkdir / home / user / restored

The custom list is now, with the help of a loop to debugfs.

Cat deletedfiles.txt | While read a b; do debugfs/dev/hda3-R "dump p <$ a > / home/user/restored/file$ a"; done

as always, the drive replace hda3, on which data should be saved.

The process may take several hours under certain circumstances. All files should be available now user / restored in/home / - unfortunately no longer with original file names, but after all the data are here again!

Method 2: grep

is grep with the package

• grep

installed by default.

Use

Enter the following in the Terminal:

grep-a b [number] [number] [search term] / dev/hda –a * > [destination-file]

More on the use you can read in grep.

Example

grep-a B200 - A600 "Thesis" / dev/hda3 >/tmp/recovered

This command saves all the data, the 200 lines above and 600 lines are found for the string "Thesis" to/dev/hda3, recovered in the file/tmp /. You can view the file in an editor [4].

Method 3: recover

Mount file system

Finally you must of course again mount the previously attached file system.

ext3 / ext4

According to Wikipedia and other sites, you can save only difficult data or no ext3 and ext4.

The program ext3rminator, which is e.g. grml where the live Linux distribution, provides a good way but lost files that were larger than 48 KB to restore. To do this, you will boot from the used LiveCD and accesses the concerned ext3 partition from there.[5] Are also some programs that were called under ext2 ext3 to use. There are at least the possibility to save files.

extundelete is a program to restore accidentally deleted files on ext3 and ext4. On the website it is described in detail how the program is applied. Found and recovered files will be placed the RECOVERED_FILES directory that is created in the current directory. Works also perfectly with a live CD and an external disk.

A little umfrangreiche, but promising guide can be found here: HOWTO recover deleted files on an ext3 file system . Also English-language instructions specifically is there for extundelete here.

FAT12/FAT16/FAT32/VFAT

This section deleted/damaged partition table is save presented tool can restore individual files. There is a HowTo on the project home page.

NTFS

Due to yet insufficient support of the file system, no optimal rescue of data is possible under Linux. For Windows, there are some useful programs, see the links on the Internet however. We recommend to mount and there to give the data with a Windows System.

Open files

Lsof command (stands for list open files), it is possible to recover accidentally deleted data when they are open at the time of deletion by another program. The rescue operation must be deleted then also immediately, because the file - simple terms - for the system always still is open, even though it was just deleted. Since this case is probably very rare, is dispensed a further explanation on this point and instead referred to the very good explanation on this page.

Save partitions

Main partition repaired if only have read access

If suddenly the following messages appear:

• "Process creation of input / output module not possible: read-only file system cannot be started."
• "Setup file /home/BENUTZERNAME/.kde/share/config/systemsettingsrc can not save."
• "/ dev/hda3: unexpected inconsistency fsck died exit status 4" (attempting to boot)

then the main partition contains a typo and therefore automatically on "-read-only".

Workaround is to check for the main partition (which is mostly hda1 and is of type ext3). To do this, start by KNOPPIX or another live CD and can now bring the main partition in order, because the partition must be mounted. To do so, is there a command in the Terminal:

sudo /sbin/fsck.ext3 v f/dev/hda1

If very many questions with "y" must be answered, you can use CTRL + C to cancel and again start the command with the following parameters: "-y".

Save partitions, if repair is not possible

gddrescue

gddrescue is a program for recovering data from damaged disks. The operation is described in the article.

dd_rescue

A complete partition is no longer readable, because for example parts of the file system is corrupted, so there is the possibility to save the still "good" data using the dd_rescue program again.

To do this, the dd_rescue of following package must be installed:

• ddrescue

The application of dd_rescue is described on the linux-user.de relatively simple and very in detail, you will find a brief description in the wiki article emergency.

The boot partition is broken, so you must run course dd_rescue from a live CD.

Note:

dd_rescue is intended for damaged partitions, for partitions that have been accidentally formatted!

 Links

• Forensic and data recovery - useful programs list
• Save deleted files on ext2
• Comfortable rescue of deleted files/directories from ext2/ext3 partitions from Windows
• debugfs man page 
• recover (manufacturer's site)
• PhotoRec 
• Allin1 
• The Sleuth Kit & autopsy
• guzu.NET, data recovery on Linux including: Extensive link list
• Data recovery with Knoppix

This article is from [march, ubuntuusers.de] and published under the "creative commons licenses"

Content provided by open-slx and possibly edited by community members.