How to Recover a File


The filesystem is of utmost importance. It is what keeps track of where the files are located, how much free space there is, etc.

When a file is deleted, the data is not actually deleted, it's still there on the disk. The information that points to where the file is located on the disk is deleted, and the space it used is marked as free. The data stays on the disk as long as it's not overwritten by new data. Thus the first thing to do is shut down the PC and not use the disk or write anything to it.

If you've deleted a file, recovering it depends on the filesystem that was used. FAT32 is very easy to recover. Others are more difficult.

This guide will help you recover the files and possibly the directory structure and filenames.

Making an Ubuntu Live USB

Download Ubuntu, a linux based OS.

If you have a 64bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-amd64.iso

If you have a 32bit PC, you'll want to use this link http://releases.ubuntu.com/16.04.4/ubuntu-16.04.4-desktop-i386.iso

If you don't know if your PC is 32bit or 64bit, downloading the 32bit will work on both.

After downloading the file, head on over to https://www.linuxliveusb.com/en/download

and install Linux Live USB Creator. Follow the instructions on how to make a Live USB.

Starting the Live USB

Plug the Live USB into the PC and turn it on.

If you aren't greeted with an ubuntu screen showing "Try Ubuntu" or "Install Ubuntu" click on Troubleshooting Starting a Live USB.

Choose "Try Ubuntu", you should get a desktop after a few mins.

If you're stuck at a black screen, click on Black Screen After Starting a Live USB.

After the desktop has loaded, start a terminal with Ctrl + Alt + T

You should see a command prompt such as ubuntu@ubuntu:~$

Assessing the situation

Type sudo parted -ls

You should get a list of the disks and partitions
ubuntu@ubuntu:~$ sudo parted -ls
Model: ATA HGST HTS541010A9 (scsi) <---- Disk name
Disk /dev/sda: 1000GB <---- Disk name as known to linux with size
Sector size (logical/physical): 512B/4096B
Partition Table: gpt <---- Partition table type (gpt or msdos)
Disk Flags:
Number  Start   End     Size    File system     Name                  Flags
 1      1049kB  316MB   315MB   fat16           EFI Partition         boot, esp
 4      316MB   9979MB  9664MB  linux-swap(v1)
 5      9979MB  16.8GB  6784MB  ext4
 2      16.8GB  896GB   880GB   ntfs            Microsoft basic data  msftdata
 3      896GB   1000GB  104GB   ext4

Model: Seagate BUP Slim BK (scsi) Disk /dev/sdb: 2000GB Sector size (logical/physical): 512B/4096B Partition Table: msdos Disk Flags: Number Start End Size Type File system Flags 1 1049kB 2000GB 2000GB primary ntfs boot

Installing Testdisk

Hook the PC up to the internet and install testdisk as indicated below

Type sudo add-apt-repository universe

then type sudo apt update

then type sudo apt install testdisk

Using Testdisk

Testdisk searches for partitions on the disk, and allows you to write a new partition table by selecting partitions. It also allows you to view the files of a partition and copy them without changing the partition table which is what we want to do.

Take note of the Partition Type of your disk in the previous output of "sudo parted -ls", you'll need it for testdisk.

Start testdisk with sudo testdisk

Choose "Create"
Select your HDD and press on "Proceed"
Select the Partition Table Type noted above. If you don't know which type it is, testdisk usually makes a good guess as to what it is and selects it for you.
Choose "Analyse"
It will show you the list of partitions it found.

Disk /dev/sda - 1000 GB / 931 GiB - CHS 121601 255 63
     Partition               Start        End    Size in sectors
 P MS Data                       34       2041       2008
 P MS Data                     2048     616447     614400 [NO NAME]
>P Linux Swap                616448   19490799   18874352
 P MS Data                 19490816   32741375   13250560
 P MS Data                 32741376 1750769663 1718028288
 P MS Data               1750769664 1953525127  202755464

Structure: Ok.  Use Up/Down Arrow keys to select partition.
Use Left/Right Arrow keys to CHANGE partition characteristics:
                P=Primary  D=Deleted
Keys A: add partition, L: load backup, T: change type,
     Enter: to continue

The numbers below "Start" are the Starting sector of the partition, the "End" column is where the partition ends.
If you highlight a partition it should say at the bottom the size in gigabytes and other information.

Use the arrow keys to highlight the partition that you deleted and press "p" to view the files. Red files are deleted ones. Press "C" to copy the files to your harddisk.
If you had a FAT filesystem it should be easy to get the files back. If you can't get the files back then you can use a program called "photorec" which comes with the testdisk package.

Using Photorec

Photorec doesn't care about the existence of a filesystem, all it does is scan the disk for files and recovers them.
It won't recover them with the directory structure. It also can be used to search for certain file types by using file headers and recover those only.

Start photorec using sudo photorec
Select your HDD
You can go to File Opt to see the list of file types it will recover, some file types aren't selected by default.
Then highlight the partition you want to search, or the whole disk and press Search
Choose where to save the files it recovers, then press "C"
It will ask about the filesystem type, for Windows filesystems and mac select FAT/NTFS/HFS+
It will recover the files in the recup_dir whereever you chose to save them.

RELATED TOPICS
Partition table, Partitions, Filesystem, Live USB, Ubuntu, Testdisk, Photorec