How to Recover a File
The filesystem is of utmost importance. It is what keeps track of where the files are located, how much free space there is, etc.
When a file is deleted, the data is not actually deleted, it's still there on the disk. The information that points to where the file is located on the disk is deleted, and the space it used is marked as free. The data stays on the disk as long as it's not overwritten by new data. Thus the first thing to do is shut down the PC and not use the disk or write anything to it.
If you've deleted a file, recovering it depends on the filesystem that was used. FAT32 is very easy to recover. Others are more difficult.
This guide will help you recover the files and possibly the directory structure and filenames.
Making an Ubuntu Live USB
Starting the Live USB
Plug the Live USB into the PC and turn it on.
If you aren't greeted with an ubuntu screen showing "Try Ubuntu" or "Install Ubuntu" click on Troubleshooting Starting a Live USB
Choose "Try Ubuntu", you should get a desktop after a few mins.
If you're stuck at a black screen, click on Black Screen After Starting a Live USB
After the desktop has loaded, start a terminal with Ctrl + Alt + T
You should see a command prompt such as ubuntu@ubuntu:~$
Assessing the situation
sudo parted -ls
You should get a list of the disks and partitions
ubuntu@ubuntu:~$ sudo parted -ls
Model: ATA HGST HTS541010A9 (scsi) <---- Disk name
Disk /dev/sda: 1000GB <---- Disk name as known to linux with size
Sector size (logical/physical): 512B/4096B
Partition Table: gpt <---- Partition table type (gpt or msdos)
Number Start End Size File system Name Flags
1 1049kB 316MB 315MB fat16 EFI Partition boot, esp
4 316MB 9979MB 9664MB linux-swap(v1)
5 9979MB 16.8GB 6784MB ext4
2 16.8GB 896GB 880GB ntfs Microsoft basic data msftdata
3 896GB 1000GB 104GB ext4
Model: Seagate BUP Slim BK (scsi)
Disk /dev/sdb: 2000GB
Sector size (logical/physical): 512B/4096B
Partition Table: msdos
Number Start End Size Type File system Flags
1 1049kB 2000GB 2000GB primary ntfs boot
Hook the PC up to the internet and install testdisk as indicated below
sudo add-apt-repository universe
sudo apt update
sudo apt install testdisk
Testdisk searches for partitions on the disk, and allows you to write a new partition table by selecting partitions. It also allows you to view the files of a partition and copy them without changing the partition table which is what we want to do.
Take note of the Partition Type of your disk in the previous output of "sudo parted -ls", you'll need it for testdisk.
Start testdisk with
Select your HDD and press on "Proceed"
Select the Partition Table Type noted above. If you don't know which type it is, testdisk usually makes a good guess as to what it is and selects it for you.
It will show you the list of partitions it found.
Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
Partition Start End Size in sectors
P MS Data 34 2041 2008
P MS Data 2048 616447 614400 [NO NAME]
>P Linux Swap 616448 19490799 18874352
P MS Data 19490816 32741375 13250560
P MS Data 32741376 1750769663 1718028288
P MS Data 1750769664 1953525127 202755464
Structure: Ok. Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
Keys A: add partition, L: load backup, T: change type,
Enter: to continue
The numbers below "Start" are the Starting sector of the partition, the "End" column is where the partition ends.
If you highlight a partition it should say at the bottom the size in gigabytes and other information.
Use the arrow keys to highlight the partition that you deleted and press "p" to view the files. Red files are deleted ones. Press "C" to copy the files to your harddisk.
If you had a FAT filesystem it should be easy to get the files back. If you can't get the files back then you can use a program called "photorec" which comes with the testdisk package.
Photorec doesn't care about the existence of a filesystem, all it does is scan the disk for files and recovers them.
It won't recover them with the directory structure. It also can be used to search for certain file types by using file headers and recover those only.
Start photorec using
Select your HDD
You can go to File Opt to see the list of file types it will recover, some file types aren't selected by default.
Then highlight the partition you want to search, or the whole disk and press Search
Choose where to save the files it recovers, then press "C"
It will ask about the filesystem type, for Windows filesystems and mac select FAT/NTFS/HFS+
It will recover the files in the recup_dir whereever you chose to save them.
, Live USB