Recovering deleted files with a Ubuntu CD

Continued from Recovering Windows files with a Ubuntu CD II: getting your files

Introduction
Usually when you delete a file from your computer, the file is still there—its space, however, is marked as available for use. Even if you reformat your hard drive and reinstall Windows (I had a friend who did this by accident, and I used Ubuntu to save her data), most of your data is probably still there.

Assuming you were able to boot the Ubuntu CD and it properly detected your internet connection, you can use a program called Photorec to recover your personal files.

If Ubuntu does not automatically detect your internet connection, and you have access to the internet on another computer, you can download the appropriate two installer files from here and here. Find a way (by USB key or iPod) to transfer them to the computer running the Ubuntu live session, and double-click libntfs10 to install it, and then double-click testdisk to install it.

This may be a bit confusing—the program we want to use is called photorec, but the program we want to install that allows us to use Photorec is called testdisk. Also, the program is called Photorec, but it recovers many types of files, not just photos.

Installing testdisk to use Photorec
First, we’re going to install the program we need in order to use Photorec.


Click on System > Administration > Synaptic Package Manager. This will open a software management program that will fetch and install software for us.


Click on Settings > Repositories.


Make sure all the checkboxes are checked (or ticked), except the CD-ROM source at the bottom. Then click Close.


Click Close again.


At the top-left corner of the Synaptic window, click Reload and wait for the new software package information to download.


Now that we’ve told the software manager to find all the software that’s available for installation, let’s install it. Click Search in the Synaptic window, in the search box type testdisk, and then click Search in the dialogue window.


testdisk should appear in the results. Right-click it and select Mark for installation.


In the Synaptic window, click Apply, and then confirm you want to apply changes by clicking Apply in the dialogue window as well.


Wait for the software to download and install.


Click Close


Quit the software manager.

Prepare backup location

You can use an external hard drive or even internal second hard drive for backup.

For an internal second hard drive, you can access it the same way you accessed the internal first hard drive (the one you’re trying to recover data from).

If the backup location is an external hard drive, you should be able to plug it in and have it automatically appear on the desktop as an icon.


Go to Applications > Accessories > Terminal


Type

df -h

in the command prompt window that appears. This will show you the path to the backup location. In this example, the backup location I’m using is 2.8 GB large, so I must make a note that it is available at /media/disk-2.

In Windows, new drives “mount” (or become available for use) as new letters (D:, E:, F:, G:, etc.). In Ubuntu, new drives mount as folders inside an all-encompassing directory. The top-level directory is slash (/). Inside that directory is subdirectory called /media, which has inside of it another subdirectory called disk-2. That’s where I want to send the recovered files to.

Recovering files with Photorec

Before you run Photorec, maximize the command terminal window. To run it, you need to run the command

sudo photorec

Don’t try to run the command photorec without sudo, as I tried to do earlier in the screenshot.


Photorec is a terminal program, so your mouse won’t work in it. You can navigate its menus with your arrow keys and then select your choices with the Enter key.

The media you are selecting is the drive you want to recover files from. Then click Enter to proceed to the next step.


Select the appropriate partition type. If in doubt, select Intel.


Select to search the whole disk.


Since this tutorial is aimed specifically at recovering Windows files, you’ll most likely choose Other for filesystem type.


This is where things get a little tricky. Photorec will assume you want to back up to a folder in Ubuntu’s /home/ubuntu directory, but you probably want to back up to an external drive (in this example, it’s /media/disk-2).


To go up a directory, go to the double-dot and press the right arrow key.


Do the same to go up yet another directory.


Select media and hit Enter.


Select the drive you want the recovered files to be saved to. In this case, it’s /media/disk-2.


Once you’ve selected the backup drive, type

Y

for Yes.


Wait for Photorec to scan for files. Depending on the size of your drive, this could take a really long time. The drive I scanned for this example is only 8.7 GB and took about 15 minutes to scan. If you have a 160 GB drive, well, you do the math.


When it’s done, you can select Quit.


Select Quit again.


Yes, select Quit a third time.


To exit the command terminal, type

exit

Checking the recovered files

If you look at the backup drive, you should see a bunch of folders full of recovered files.


Every folder will have a mix of different file types. Some files will be music files. Others will be Word documents. There will be pictures and text files. All sorts of stuff you may not even care about. The labels will be random, so even though you have your files back, it’ll be up to you to reorganize them and rename them appropriately.


To get out of the live CD, go to System > Quit.


Select the appropriate option, probably Restart.


Wait for the live session to fully end, and then press Enter to reboot after the CD ejects.


After you reboot into Windows, you should be able to access the recovered files.

Congratulations! You just saved yourself hundreds of dollars, learned something new, dabbled in Linux (Ubuntu specifically), and didn’t give up access to your computer for days or weeks.

You should, of course, always back up your files, but it’s also good to know there are free and easy ways to recover your data otherwise.

If you need any help with this process, please feel free to post a support thread in the Absolute Beginner subforum of the Ubuntu Forums.

48 comments

  1. I was wondering if these methods would work on a Mac as well.
    By the way thanks for all your efforts to assist people like me with limited computer knowledge.

  2. Yes, they will work for Mac as well, with a few modifications:

    1. If you have an older Mac (Powerbook, iBook), you should make sure to get a PowerPC version of Linux.

    2. If you want to boot from CD, you hold down the C key while booting up.

    3. If you’re using photorec, the filesystem type is HFS+ (not NTFS or Ext3 or FAT32).

  3. This works great, and saved me thousands of family photos that my wife failed to back up. My only gripe was that the text documents it recovered are somehow full of junk, or are simply misreporting their size. I can take a 162 megabyte file, select all the text in the document, put it in a new document of the same type, and it will be 1k or less. I had over 80 gigs free to recover a 40 gig drive and because of this issue filled the drive. Thankfully I was smart enough not to have it be my drive with the root partition on it, but it was still aggravating. But, it was better than loosing all the files too! Beggars can’t be choosers I suppose.

  4. AWESOME, simply awesome instructions! I wish I had stumbled on this thread a couple weeks ago, before I trashed my old harddrive because I didn’t think it was recoverable. Thank goodness, I didn’t lose much, but it would’ve been nice to have it back. I certainly will have ‘better luck next time’.. thanks to The Great Aysiu! You couldn’t have made it any easier than you did!

  5. hi,

    Will this Software be able to recover files from PCs which have Deep Freeze installed in it.

    Mongoo

  6. Thank you very much! This was very helpfull.

    One thing I am realizing as my computer is retrieving the deleted video and pictures is that videos are also called pgn files and when I click on them they open in a picture viewer rather than a movie player program. Any suggestions as to why that would happen?

  7. I don’t what pgn files are. png files are image files, though, and should open in a picture viewer. They may be thumbnails of the video files instead of the actual videos.

  8. Actually,

    All my pictures and my videos are just thumbnails now, so it seems like what I have retrieved was the thumbnails of everything. Have I done something wrong in the process for this to happen? I have not specified a different place to save the files though I just let the computer save them in the c drive. could that be the reason? If I saved them to a flash drive would anything be different?

    Also what do you recommend i do now?

  9. It’s possible that the videos have been overwritten and are just now unrecoverable. Or maybe you’re doing something wrong.

    I would recommend you start a thread on the Ubuntu Forums asking for help. The folks there are both helpful and knowledgeable. It’ll be far more productive than trying to get support through comments on my blog post.

  10. I had already recovered a bunch of files off of a failed drive with photorec, but it is a good tutorial. I will send this to my friend who still thinks proprietary software is better than FOSS software for data recovery. And this also works great with external drives. Just do a normal Ubuntu install to an external drive, install the boot loader to the external drive (instead of main HDD) and then install all the drive/file rescue tools you will need.

  11. hi,
    will this work for windows XP?I formatted my C drive without taking the backup.I later realized that i left some important files on my desktop.can i somehow recover them back?Plz help me……..

  12. Thanks. Very helpful for my ubuntu system.
    There are so many random files left over for old users (2nd hand laptop).

  13. hey bro, i’m using windows Xp. n i’ve installed the software “deep freeze” for the C drive only… by mistakelly i’ve stored some of my data on my desk top…. n due to power cut i loose all that data… the data was in the form of excel files, word file, photos, videos, mp3, some softwares… can u plzzz plzz plzzzz tell me how can i recover the data which was deleted by deep freeze…. its a request dear…. plzz help me out…

  14. thnkzzzz a lotz,now i recvr my precius photos includin n bday’s snapes, my old frenz snapes etcc…..thnk u so much……….

  15. Please help! I’m trying to recover jpeg files from master HD Ubuntu partition by using photorec on latest Rescue-Remix live CD. Intend to put recovered files into secondary (slave) HD. And stumbling at choosing it…
    When booting into R-R live CD, both HDs listed, then I choose master to recover files from, go thru options till choosing secondary internal HD to put recovered files into, and it is not in the list… When checked previously it’s labeled Media/Disk, but when I go twice up directory thru double dot to Media, “Disc” is not there…
    I tested this procedure with secondary internal HD disconnected – and all lines in menu are exactly the same when trying to choose the secondary internal drive to put files into…

    What to do? Should I mount secondary internal HD in Rescue-Remix before starting photorec? or what else?
    Please help!

  16. Used Photorec on Ubuntu Rescue-Remix CD yesterday to recover deleted files in Ubuntu.

    Lessons learned:
    If using secondary internal HD (suspect the same for external HD) for recovered file import (from main HD, where the files originally were), it’s necessary to make a directory, into which the files will be put in on secondary HD.
    To do it, you need to have BIOS setting for booting from CD first!
    1. Start Live Ubuntu Rescue-Remix CD, give command to boot, then when it boots into terminal, check your HDs by command – Code: sudo fdisk -l

    Realize what HD is main, and which is secondary, and what partition to check for files and into which to recover them – linux ext3 or Windows NTFS! Mine was Linux. Have enough room on it!
    (Then you can try to run Photorec (“sudo photorec”) and hopefully you’ll be able to see all your HDs. I was not that lucky, so I had to make directory and mount sec. HD.)

    2. Make directory for recovered files first, e.g. – media/disk. Give command – Code: sudo mkdir /media/disk

    If alright, terminal prompt simply returns.

    3. Must mount secondary HD, or it’ll be invisible, even if “sudo fdisk -l” does show it. Give command for your secondary HD –
    Code: sudo mount -t ext3 /dev/sdb2 /media/disk

    If alright, terminal prompt simply returns.

    4. Run Photorec by command – Code: sudo photorec

    Go thru settings, and only choose file types that you want, otherwise you’ll have thousands of files to sift thru! I had 25000.
    ————————————————————–

    Unfortunately, I did not find my photos (jpegs) in recovered files…
    I suspect they were over-written, and I’m not sure if it’s possible to recover them… Is it? If anyone knows, please tell me!
    Will try DD rescue and others in upcoming days.

    Good luck to everybody!

  17. I got a segmentation fault error after about an hour and a half of scanning my 300GB external.

    I had accidentally reformatted and installed ubuntu on this external (chose the wrong drive during setup X/) and am trying to get some of the files back that haven’t been overwritten. Some of the files have been recovered up until the segfault. Any ideas as to why this may be happening and were I whould go from here?

  18. Hello,

    Unfortunately , after going up a directory 2 times by pressing the right arrow key on the double-dot, the pendrives weren’t listed and I can’t go any further. This happens each time I restard the process, even though when I hit the command df -h they initially appear to me… :((

  19. Sorry for what I posted earlier. Problem solved. However, due to the fact that I am using a 4Gb pendrive on which to save the recovered data, and the recovered data is much larger than 4 Gb, how am I to recover it all ? Should I buy an external HDD ? Thank you so much !

  20. will this work if i take out my hard drive, put it in an enclosure and hook it up to my pc? i really don’t want to go the route of the cd because getting back on my broken computer depresses me. my question is a bit off, what i meant to ask is can i use this method without the cd (instead have a disk enclosure)?

  21. Yes, and Photorec is available for Mac and Windows as well (not just Linux). Just make sure you have enough space to store the recovered files. You may need a second external hard drive if your internal drive can’t handle it.

  22. Many thanks for your great tutorial. I easily recovered my laptop harddisk (NTFS) via my normal home computer running Ubuntu. Many Many thanks again.

  23. Hi Ubuntucat, I had the same prob too while using ubuntu10.10. I am using an external HDD to place my recovered files but I cant find it in the media directory

  24. i managed to locate it but my recovery was halted prematurely by segmentation fault (core dumped)

    does that mean my files are unrecoverable?

  25. i accidentally formatted my hard disk and i am having important files and folders in the hard disk, please help, tell me how would i recover these files and folders using windows XP setup, and if possible tell me the names of other softwares to use to carry out such operations. am a Nigerian and also a student of F.C.E Pankshin. Then i would also appreciate if you tell m where to get this softwares here in Nigeria.Thanks

  26. I deleted all my song files from my ipod nano (classic) will this program help me recover my files.

    Thanks

  27. Using photorec,I want to recover only the jpg files.How can I select only the jpg format? In the file option menu all the formats are selected.So recovering thosands of files.How can I manage it?

  28. ksta…go to file opt…and press i think its “s” which deselects all file extensions and then you use the arrow keys to navigate down to the .jpg extension and press the right arrow key which selects that format only. Press “b” which saves the requested options. Then press “q” and it will go back to the previous screen. There ya go hope that helped :D

  29. I’m trying to recover deleted images off a 3g iPhone. It’s mounted and I can explore the current photos through the files system, but it won’t show up as a media option to recover from in the first menu. Any ideas?

  30. If you are using Ubuntu, then it can be quite a huge problem if you accidentally delete some files.. But worry not, since now you can recover your files in Ubuntu too.

    Scalpel is one of the best command line tool to recover deleted files in Ubuntu Linux. It can recover almost all types of files.

    Foremost is a console program to recover files based on their headers, footers, and internal data structures. For more details you may please visit: “http:/www..ubuntumanual.org/posts/357/recover-your-deleted-files-in-ubuntu”

  31. I have a question. I accidentally replaced a txt. file on Notepad. Will Ubuntucat be able to get it back and if it can’t do you know of any other way I would be able to get it back? I’ve heard a few people say that forensic data recovery would be the only way but it’s pretty expensive.

    Thank you.

  32. can i recover the photos deleted from the camera roll in my ipod touch 4g?i don’t have a backup and the ipod is jailbroke.

  33. Hi, Thanks for the ap, this has been a great tool and has recovered some very important files. I would like to know if it is possible to start the scan from a specific sector rather than from the start? I have a damaged drive that took 125 ish hours to scan and didn’t quite finish.

  34. Thank you for an easy to understand and step by step instruction set. I followed another one that omitted some vital steps that you thoughtfully included and ended up having to reinstall my Ubuntu and Windows installation as a result. One small thing. The recovered files are locked and defy being deleted. Any suggestions?

  35. The file may be locked by owner.
    you may have to change the owner by:
    Opening a terminal
    Type: sudo su
    enter the admin password
    (for giggles, we will say your user name is: user)
    (also, we will say the IPOD folder is on the Desktop of user)
    Change the owner of the files recursively (all the files inside the folder)
    Type: chown -R user:user /home/user/Desktop/IPOD

    The login of user should now have full access to that folder and all its files.

    Hope that help Don..
    BTW, Yes this works for iPads/iPods

  36. Follow up:
    For iOS devices, you need to know where the device is being mounted in /dev.
    Easy way is to:
    Start with device unplugged.
    Open a terminal
    Type: sudo su
    Enter in the admin password
    For Ubuntu type: tail -f /var/lib/syslog
    Plug the device into the PC.
    You will see something like this:
    Jul 22 19:32:01 ubuntu kernel: [ 8127.100592] scsi 33:0:0:0: Direct-Access Apple iPod 1.70 PQ: 0 ANSI: 0
    Jul 22 19:32:01 ubuntu kernel: [ 8127.295300] sd 33:0:0:0: [sdb] 3901376 4096-byte logical blocks: (15.9 GB/14.8 GiB)

    My iPod is mounted on sdb
    I made a folder on my Desktop.
    Type: mkdir /home/user/Desktop/IPOD
    Change to that directory.
    Type: cd /home/user/Desktop/IPOD
    Now run photorec
    Type: photorec /dev/sdb

    You can take all the defaults and it should recover your files fine.

    Good Luck:
    GunDeck

  37. First off, thanks a bunch for this nice tutorial.
    Secondly, what to do should you encounter this message “Can’t open filesystem. Filesystem seems damaged.”. Is this the end of the road, at least with TestDisk?
    Thanks

    DPC

  38. Thanks for the clear tutorial. Impressive program, last version works great and easier in october 2018 (on Lubuntu 14.04)

    Just wondering now how to permanent delete from Trash folder the 8Gb of files recovered sended there by me after finish.

    Is there an easy way than the suggested at the PhotoRec FAQs?
    (“Change the owner of the files, example sudo chown -R username recup_dir.* or sudo chown -R username /home/username/testdisk-6.14/recup_dir.*. (When asked for the password, use the password from your user session to validate the sudo command”)

    Thank you all in advance!

    1. That’s probably safest (change ownership of the files to your username, put them in the trash graphically, and then empty the trash), because you aren’t invoking a potentially dangerous command.

      If you want to live dangerously, and you aren’t worried about hitting the Return key prematurely, you can also remove those files immediately without changing ownership first: sudo rm -rf recup_dir.*

Leave a comment

Your email address will not be published. Required fields are marked *