Recover your lost data or deleted file using Linux with PhotoRec

This article will explain how to use PhotoRec, a French software specialized in data recovery. Also note that it is also available for Windows.

1. First step

Most file systems won’t really delete your data. They generally expect to have new instructions to replace the space that was allocated to the file.

Your first impulse will be placed to remove the partition and then put it back in read-only mode. So we will increase the chances of recovery.

Therefore be used commands like:

Umount / dev/sda3
Mount-r / dev/sda3 / home


2. Installing PhotoRec

Distributed under the GNU General Public License, PhotoRec supports most file systems (FAT, NTFS, EXT2 / 3 ...). It should be noted that the latter is included in the package Testdisk.

To install, therefore, will be launched the following command to a distribution based rpm (Fedora, CentOS, RedHat ...):

Yum install testdisk


Or this command to a distribution based on Debian (Ubuntu, Debian ...):

Apt-get install testdisk



3. Using PhotoRec

PhotoRec Launch:

Photorec

And choose the hard disk concerned:

Select a media (use Arrow keys, then press Enter):
Disk / dev / sda - 20 GB / 18 GiB
Disk / dev / sdb - 250 GB / 233 GiB

Then type associated system (utility manages even game consoles Xbox):

Please select the partition table type, press Enter when done.
[Intel] Intel / PC partition
[Mac] Apple partition map
[None] No partitioned media
[Sun] Sun Solaris partition
[XBox] XBox partition

And the partition you want and its filesystem:

To recover lost files, PhotoRec need to know the type where the filesystem
File were stored:
[EXT2/EXT3] filesystem EXT2/EXT3
[Other] FAT / NTFS / HFS + / ReiserFS / ...

The final step will be to choose a folder will be stored where all the recovered files. It is also advisable to use another partition that contains the data to be recovered.

It will then begin the process of recovery, displaying something like this:

Pass 1 - Reading 1482914/16322040 sector, 588 files found
Elapsed time 0h00m22s - Estimated time for achievement 0h03m40
TXT: 33669 recovered
IPF: 248 recovered
PNG: 209 recovered
JPG: 197 recovered
TX?: 70 recovered
GZ: 42 recovered
MP3: 11 recovered
ZIP: 11 recovered
SWF: 5 recovered
BMP: 3 recovered
Others: 5 recovered



4. After recovering

The problem is that now finds himself with a lot of files named recup_dir.1, recup_dir.2 ... Containing all of a multitude of different files with the extensions.

It will then use different commands to be able to eventually find the files erased.

Here are some examples of commands:

-- Find all the MP3 files: find recup_dir .*-name "*. mp3"
-- Find all files of more than 100 mo: find recup_dir .*-size +100 M
-- Find all files containing the string "Tux-planet": grep-R "Tux-planet" recup_dir .*

Another solution might be to sort the files according to their extension, using this script:

#! / Bin / bash
For i in `find. - Type f `
Do
If [-f $ i]; then
Dir = $ (echo $ i awk-F '. "' (Print $ 3) ')
Mkdir-p "$ dir" & & mv "$ i" "$ dir"
Fi
Done

Whether we use like this:

Chmod 755 tri-file-extension.sh
. / Tri-file-extension.sh

In short, a little craft as a method, but it is still better than nothing.