Recovering deleted files with a Ubuntu CD
August 5th, 2008
Continued from Recovering Windows files with a Ubuntu CD II: getting your files
Introduction
Usually when you delete a file from your computer, the file is still there—its space, however, is marked as available for use. Even if you reformat your hard drive and reinstall Windows (I had a friend who did this by accident, and I used Ubuntu to save her data), most of your data is probably still there.
Assuming you were able to boot the Ubuntu CD and it properly detected your internet connection, you can use a program called Photorec to recover your personal files.
If Ubuntu does not automatically detect your internet connection, and you have access to the internet on another computer, you can download the appropriate two installer files from here and here. Find a way (by USB key or iPod) to transfer them to the computer running the Ubuntu live session, and double-click libntfs10 to install it, and then double-click testdisk to install it.
This may be a bit confusing—the program we want to use is called photorec, but the program we want to install that allows us to use Photorec is called testdisk. Also, the program is called Photorec, but it recovers many types of files, not just photos.
Installing testdisk to use Photorec
First, we’re going to install the program we need in order to use Photorec.
Click on System > Administration > Synaptic Package Manager. This will open a software management program that will fetch and install software for us.
Click on Settings > Repositories.
Make sure all the checkboxes are checked (or ticked), except the CD-ROM source at the bottom. Then click Close.
Click Close again.
At the top-left corner of the Synaptic window, click Reload and wait for the new software package information to download.
Now that we’ve told the software manager to find all the software that’s available for installation, let’s install it. Click Search in the Synaptic window, in the search box type testdisk, and then click Search in the dialogue window.
testdisk should appear in the results. Right-click it and select Mark for installation.
In the Synaptic window, click Apply, and then confirm you want to apply changes by clicking Apply in the dialogue window as well.
Wait for the software to download and install.
Click Close
Quit the software manager.
Prepare backup location
You can use an external hard drive or even internal second hard drive for backup.
For an internal second hard drive, you can access it the same way you accessed the internal first hard drive (the one you’re trying to recover data from).
If the backup location is an external hard drive, you should be able to plug it in and have it automatically appear on the desktop as an icon.
Go to Applications > Accessories > Terminal
Type
in the command prompt window that appears. This will show you the path to the backup location. In this example, the backup location I’m using is 2.8 GB large, so I must make a note that it is available at /media/disk-2.
In Windows, new drives “mount” (or become available for use) as new letters (D:, E:, F:, G:, etc.). In Ubuntu, new drives mount as folders inside an all-encompassing directory. The top-level directory is slash (/). Inside that directory is subdirectory called /media, which has inside of it another subdirectory called disk-2. That’s where I want to send the recovered files to.
Recovering files with Photorec
Before you run Photorec, maximize the command terminal window. To run it, you need to run the command
Don’t try to run the command photorec without sudo, as I tried to do earlier in the screenshot.
Photorec is a terminal program, so your mouse won’t work in it. You can navigate its menus with your arrow keys and then select your choices with the Enter key.
The media you are selecting is the drive you want to recover files from. Then click Enter to proceed to the next step.
Select the appropriate partition type. If in doubt, select Intel.
Select to search the whole disk.
Since this tutorial is aimed specifically at recovering Windows files, you’ll most likely choose Other for filesystem type.
This is where things get a little tricky. Photorec will assume you want to back up to a folder in Ubuntu’s /home/ubuntu directory, but you probably want to back up to an external drive (in this example, it’s /media/disk-2).
To go up a directory, go to the double-dot and press the right arrow key.
Do the same to go up yet another directory.
Select media and hit Enter.
Select the drive you want the recovered files to be saved to. In this case, it’s /media/disk-2.
Once you’ve selected the backup drive, type
for Yes.
Wait for Photorec to scan for files. Depending on the size of your drive, this could take a really long time. The drive I scanned for this example is only 8.7 GB and took about 15 minutes to scan. If you have a 160 GB drive, well, you do the math.
When it’s done, you can select Quit.
Select Quit again.
Yes, select Quit a third time.
To exit the command terminal, type
Checking the recovered files
If you look at the backup drive, you should see a bunch of folders full of recovered files.
Every folder will have a mix of different file types. Some files will be music files. Others will be Word documents. There will be pictures and text files. All sorts of stuff you may not even care about. The labels will be random, so even though you have your files back, it’ll be up to you to reorganize them and rename them appropriately.
To get out of the live CD, go to System > Quit.
Select the appropriate option, probably Restart.
Wait for the live session to fully end, and then press Enter to reboot after the CD ejects.
After you reboot into Windows, you should be able to access the recovered files.
Congratulations! You just saved yourself hundreds of dollars, learned something new, dabbled in Linux (Ubuntu specifically), and didn’t give up access to your computer for days or weeks.
You should, of course, always back up your files, but it’s also good to know there are free and easy ways to recover your data otherwise.
If you need any help with this process, please feel free to post a support thread in the Absolute Beginner subforum of the Ubuntu Forums.
August 31st, 2008 at 23:09
I was wondering if these methods would work on a Mac as well.
By the way thanks for all your efforts to assist people like me with limited computer knowledge.
September 1st, 2008 at 02:49
Yes, they will work for Mac as well, with a few modifications:
1. If you have an older Mac (Powerbook, iBook), you should make sure to get a PowerPC version of Linux.
2. If you want to boot from CD, you hold down the C key while booting up.
3. If you’re using photorec, the filesystem type is HFS+ (not NTFS or Ext3 or FAT32).
October 5th, 2008 at 12:46
This works great, and saved me thousands of family photos that my wife failed to back up. My only gripe was that the text documents it recovered are somehow full of junk, or are simply misreporting their size. I can take a 162 megabyte file, select all the text in the document, put it in a new document of the same type, and it will be 1k or less. I had over 80 gigs free to recover a 40 gig drive and because of this issue filled the drive. Thankfully I was smart enough not to have it be my drive with the root partition on it, but it was still aggravating. But, it was better than loosing all the files too! Beggars can’t be choosers I suppose.
November 9th, 2008 at 14:10
Thank you so much! Another great easy-to-follow, newbie-friendly guide by The Great Aysiu! :P
January 27th, 2009 at 14:34
AWESOME, simply awesome instructions! I wish I had stumbled on this thread a couple weeks ago, before I trashed my old harddrive because I didn’t think it was recoverable. Thank goodness, I didn’t lose much, but it would’ve been nice to have it back. I certainly will have ‘better luck next time’.. thanks to The Great Aysiu! You couldn’t have made it any easier than you did!
January 31st, 2009 at 14:14
Can i use this to retrieve a .dv video file?
February 2nd, 2009 at 09:41
hi,
Will this Software be able to recover files from PCs which have Deep Freeze installed in it.
Mongoo
February 2nd, 2009 at 12:05
@Rowan
Yes, it will:
http://www.cgsecurity.org/wiki/File_Formats_Recovered_By_PhotoRec
@Mongoo
I don’t know, because I don’t really know how Deep Freeze works. If Deep Freeze writes changes temporarily to disk and then erases the changes afterwards, then Photorec should work. If, however, Deep Freeze writes changes only to RAM, then Photorec will not work, because the files were never on the hard drive to begin with.
March 1st, 2009 at 11:42
Thanks.
March 22nd, 2009 at 22:23
Thank you very much! This was very helpfull.
One thing I am realizing as my computer is retrieving the deleted video and pictures is that videos are also called pgn files and when I click on them they open in a picture viewer rather than a movie player program. Any suggestions as to why that would happen?
March 23rd, 2009 at 19:07
I don’t what pgn files are. png files are image files, though, and should open in a picture viewer. They may be thumbnails of the video files instead of the actual videos.
March 24th, 2009 at 15:04
Actually,
All my pictures and my videos are just thumbnails now, so it seems like what I have retrieved was the thumbnails of everything. Have I done something wrong in the process for this to happen? I have not specified a different place to save the files though I just let the computer save them in the c drive. could that be the reason? If I saved them to a flash drive would anything be different?
Also what do you recommend i do now?
March 24th, 2009 at 16:15
It’s possible that the videos have been overwritten and are just now unrecoverable. Or maybe you’re doing something wrong.
I would recommend you start a thread on the Ubuntu Forums asking for help. The folks there are both helpful and knowledgeable. It’ll be far more productive than trying to get support through comments on my blog post.
May 15th, 2009 at 16:38
Thanks. That worked…
June 15th, 2009 at 04:48
I had already recovered a bunch of files off of a failed drive with photorec, but it is a good tutorial. I will send this to my friend who still thinks proprietary software is better than FOSS software for data recovery. And this also works great with external drives. Just do a normal Ubuntu install to an external drive, install the boot loader to the external drive (instead of main HDD) and then install all the drive/file rescue tools you will need.
August 11th, 2009 at 18:46
hi,
will this work for windows XP?I formatted my C drive without taking the backup.I later realized that i left some important files on my desktop.can i somehow recover them back?Plz help me……..
August 11th, 2009 at 19:38
Yes, it works for anything. XP, Vista, 7, Panther, Tiger, Leopard, Jaunty, Hardy.
It doesn’t what operating system is installed.
August 21st, 2009 at 07:12
Thanks. Very helpful for my ubuntu system.
There are so many random files left over for old users (2nd hand laptop).
August 24th, 2009 at 18:44
hey bro, i’m using windows Xp. n i’ve installed the software “deep freeze” for the C drive only… by mistakelly i’ve stored some of my data on my desk top…. n due to power cut i loose all that data… the data was in the form of excel files, word file, photos, videos, mp3, some softwares… can u plzzz plzz plzzzz tell me how can i recover the data which was deleted by deep freeze…. its a request dear…. plzz help me out…
November 8th, 2009 at 04:51
thnkzzzz a lotz,now i recvr my precius photos includin n bday’s snapes, my old frenz snapes etcc…..thnk u so much……….
December 9th, 2009 at 20:20
Please help! I’m trying to recover jpeg files from master HD Ubuntu partition by using photorec on latest Rescue-Remix live CD. Intend to put recovered files into secondary (slave) HD. And stumbling at choosing it…
When booting into R-R live CD, both HDs listed, then I choose master to recover files from, go thru options till choosing secondary internal HD to put recovered files into, and it is not in the list… When checked previously it’s labeled Media/Disk, but when I go twice up directory thru double dot to Media, “Disc” is not there…
I tested this procedure with secondary internal HD disconnected – and all lines in menu are exactly the same when trying to choose the secondary internal drive to put files into…
What to do? Should I mount secondary internal HD in Rescue-Remix before starting photorec? or what else?
Please help!
December 12th, 2009 at 01:10
Used Photorec on Ubuntu Rescue-Remix CD yesterday to recover deleted files in Ubuntu.
Lessons learned:
If using secondary internal HD (suspect the same for external HD) for recovered file import (from main HD, where the files originally were), it’s necessary to make a directory, into which the files will be put in on secondary HD.
To do it, you need to have BIOS setting for booting from CD first!
1. Start Live Ubuntu Rescue-Remix CD, give command to boot, then when it boots into terminal, check your HDs by command – Code: sudo fdisk -l
Realize what HD is main, and which is secondary, and what partition to check for files and into which to recover them – linux ext3 or Windows NTFS! Mine was Linux. Have enough room on it!
(Then you can try to run Photorec (“sudo photorec”) and hopefully you’ll be able to see all your HDs. I was not that lucky, so I had to make directory and mount sec. HD.)
2. Make directory for recovered files first, e.g. – media/disk. Give command – Code: sudo mkdir /media/disk
If alright, terminal prompt simply returns.
3. Must mount secondary HD, or it’ll be invisible, even if “sudo fdisk -l” does show it. Give command for your secondary HD –
Code: sudo mount -t ext3 /dev/sdb2 /media/disk
If alright, terminal prompt simply returns.
4. Run Photorec by command – Code: sudo photorec
Go thru settings, and only choose file types that you want, otherwise you’ll have thousands of files to sift thru! I had 25000.
————————————————————–
Unfortunately, I did not find my photos (jpegs) in recovered files…
I suspect they were over-written, and I’m not sure if it’s possible to recover them… Is it? If anyone knows, please tell me!
Will try DD rescue and others in upcoming days.
Good luck to everybody!
June 27th, 2010 at 17:23
I got a segmentation fault error after about an hour and a half of scanning my 300GB external.
I had accidentally reformatted and installed ubuntu on this external (chose the wrong drive during setup X/) and am trying to get some of the files back that haven’t been overwritten. Some of the files have been recovered up until the segfault. Any ideas as to why this may be happening and were I whould go from here?
July 5th, 2010 at 05:50
Hello,
Unfortunately , after going up a directory 2 times by pressing the right arrow key on the double-dot, the pendrives weren’t listed and I can’t go any further. This happens each time I restard the process, even though when I hit the command df -h they initially appear to me… :((
July 5th, 2010 at 06:05
Sorry for what I posted earlier. Problem solved. However, due to the fact that I am using a 4Gb pendrive on which to save the recovered data, and the recovered data is much larger than 4 Gb, how am I to recover it all ? Should I buy an external HDD ? Thank you so much !
August 1st, 2010 at 04:39
will this work if i take out my hard drive, put it in an enclosure and hook it up to my pc? i really don’t want to go the route of the cd because getting back on my broken computer depresses me. my question is a bit off, what i meant to ask is can i use this method without the cd (instead have a disk enclosure)?
August 1st, 2010 at 11:12
Yes, and Photorec is available for Mac and Windows as well (not just Linux). Just make sure you have enough space to store the recovered files. You may need a second external hard drive if your internal drive can’t handle it.
August 12th, 2010 at 16:34
Many thanks for your great tutorial. I easily recovered my laptop harddisk (NTFS) via my normal home computer running Ubuntu. Many Many thanks again.
November 4th, 2010 at 12:41
Hi Ubuntucat, I had the same prob too while using ubuntu10.10. I am using an external HDD to place my recovered files but I cant find it in the media directory
November 7th, 2010 at 07:19
i managed to locate it but my recovery was halted prematurely by segmentation fault (core dumped)
does that mean my files are unrecoverable?
November 18th, 2010 at 10:21
i accidentally formatted my hard disk and i am having important files and folders in the hard disk, please help, tell me how would i recover these files and folders using windows XP setup, and if possible tell me the names of other softwares to use to carry out such operations. am a Nigerian and also a student of F.C.E Pankshin. Then i would also appreciate if you tell m where to get this softwares here in Nigeria.Thanks
April 4th, 2011 at 15:24
u saved my day….. i’m an ubuntu lover n now i luv it evn more…:)
April 7th, 2011 at 12:32
I deleted all my song files from my ipod nano (classic) will this program help me recover my files.
Thanks
April 23rd, 2011 at 16:51
Thanks a loooooot… i got my stuff back.
May 14th, 2011 at 00:01
Using photorec,I want to recover only the jpg files.How can I select only the jpg format? In the file option menu all the formats are selected.So recovering thosands of files.How can I manage it?
June 3rd, 2011 at 05:33
ksta…go to file opt…and press i think its “s” which deselects all file extensions and then you use the arrow keys to navigate down to the .jpg extension and press the right arrow key which selects that format only. Press “b” which saves the requested options. Then press “q” and it will go back to the previous screen. There ya go hope that helped :D
June 30th, 2011 at 19:26
I’m trying to recover deleted images off a 3g iPhone. It’s mounted and I can explore the current photos through the files system, but it won’t show up as a media option to recover from in the first menu. Any ideas?
July 2nd, 2011 at 07:09
If you are using Ubuntu, then it can be quite a huge problem if you accidentally delete some files.. But worry not, since now you can recover your files in Ubuntu too.
Scalpel is one of the best command line tool to recover deleted files in Ubuntu Linux. It can recover almost all types of files.
Foremost is a console program to recover files based on their headers, footers, and internal data structures. For more details you may please visit: “http:/www..ubuntumanual.org/posts/357/recover-your-deleted-files-in-ubuntu”
October 29th, 2011 at 10:12
how to specify to recovery only jpeg files ?
thanks.
January 30th, 2012 at 04:45
I have a question. I accidentally replaced a txt. file on Notepad. Will Ubuntucat be able to get it back and if it can’t do you know of any other way I would be able to get it back? I’ve heard a few people say that forensic data recovery would be the only way but it’s pretty expensive.
Thank you.
April 18th, 2012 at 06:10
can i recover the photos deleted from the camera roll in my ipod touch 4g?i don’t have a backup and the ipod is jailbroke.
August 8th, 2012 at 10:53
Hi, Thanks for the ap, this has been a great tool and has recovered some very important files. I would like to know if it is possible to start the scan from a specific sector rather than from the start? I have a damaged drive that took 125 ish hours to scan and didn’t quite finish.
December 20th, 2013 at 02:24
Thank you for an easy to understand and step by step instruction set. I followed another one that omitted some vital steps that you thoughtfully included and ended up having to reinstall my Ubuntu and Windows installation as a result. One small thing. The recovered files are locked and defy being deleted. Any suggestions?
July 22nd, 2014 at 23:26
The file may be locked by owner.
you may have to change the owner by:
Opening a terminal
Type: sudo su
enter the admin password
(for giggles, we will say your user name is: user)
(also, we will say the IPOD folder is on the Desktop of user)
Change the owner of the files recursively (all the files inside the folder)
Type: chown -R user:user /home/user/Desktop/IPOD
The login of user should now have full access to that folder and all its files.
Hope that help Don..
BTW, Yes this works for iPads/iPods
July 22nd, 2014 at 23:41
Follow up:
For iOS devices, you need to know where the device is being mounted in /dev.
Easy way is to:
Start with device unplugged.
Open a terminal
Type: sudo su
Enter in the admin password
For Ubuntu type: tail -f /var/lib/syslog
Plug the device into the PC.
You will see something like this:
Jul 22 19:32:01 ubuntu kernel: [ 8127.100592] scsi 33:0:0:0: Direct-Access Apple iPod 1.70 PQ: 0 ANSI: 0
Jul 22 19:32:01 ubuntu kernel: [ 8127.295300] sd 33:0:0:0: [sdb] 3901376 4096-byte logical blocks: (15.9 GB/14.8 GiB)
My iPod is mounted on sdb
I made a folder on my Desktop.
Type: mkdir /home/user/Desktop/IPOD
Change to that directory.
Type: cd /home/user/Desktop/IPOD
Now run photorec
Type: photorec /dev/sdb
You can take all the defaults and it should recover your files fine.
Good Luck:
GunDeck