Undeleting files with linux testdisk

The linux command testdisk is a powerful utility for all kinds of disk repair but I use it once in a while to recover accidently deleted files. Most distributions include the testdisk command otherwise see https://www.cgsecurity.org/wiki/TestDisk for details.

You can use testdisk on a mounted disk. That is: you can undelete files from the the computer you are working on. It does not change the directory where the accidently deleted file was. It gives you a copy of that file. The problem with working on the main disk of your computer is that all kinds of transactions and logging are going on at any time. There is a chance that the file you would like to undelete is no longer there.

My use-case for undeleting files is to recover accidently deleted camera images. I transfer my images from the digital camera to my computer and then I go through them to remove photos that I do not want to keep (under exposed images, blurred images, duplicates, etc...). I do also rename the files to sort them by time (with the command exifdate) and I give the files a descriptive name in addition to the timestamp.

During this process it has happened that I deleted accidentally the wrong file. The best solution is to recover the file from the camera's SD card. The camera is off while I work on the computer and the SD card content does not change. There is almost a 100% chance that the photo is still on the camera and undelete will work.

Procedure to undelete files with linux testdisk

Get a usb SD card adapter such that you could mount the SD card on your computer.
If your sdcard mountes from /dev/sdb1
then you would run the command:
testdisk /dev/sdb
as user root. That is: run testdisk on the disk not the partitition (sdb not sdb1).
Read the screen, confirm the disk and press proceed

You get to a menu that looks like this:

TestDisk 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org


Disk /dev/sdb - 4009 MB / 3824 MiB

Please select the partition table type, press Enter when done.
>[Intel  ] Intel/PC partition
 [EFI GPT] EFI GPT partition map (Mac i386, some x86_64...)
 [Humax  ] Humax partition table
 [Mac    ] Apple partition map
 [None   ] Non partitioned media
 [Sun    ] Sun Solaris partition
 [XBox   ] XBox partition
 [Return ] Return to disk selection

Select "[Intel ] Intel/PC partition"

in the next menu select advanced:

TestDisk 7.0, Data Recovery Utility, April 2015
http://www.cgsecurity.org


Disk /dev/sdb - 4009 MB / 3824 MiB
     CHS 1018 124 62 - sector size=512

 [ Analyse  ] Analyse current partition structure and search for lost partitions
>[ Advanced ] Filesystem Utils
 [ Geometry ] Change disk geometry
 [ Options  ] Modify options
 [ MBR Code ] Write TestDisk MBR code to first sector
 [ Delete   ] Delete all data in the partition table
 [ Quit     ] Return to disk selection

In the next menu select the partion and then [List] from the bottom of the screen.
deleted files are shown in red and you can navigate into the different folders. You need to have a rough idea as to what the file name was. E.g the last few digits of the number that the camera adds to the file name.
testdisk will ask you were to store the if you copy to "/root/." then you will find the files in this directory + the sub directory of the disk from were you undelete. Your camera images might e.g be copied to /root/DCIM/108_PANA/

testdisk is a great untility it has saved me a few times.

Back to: "No preservatives added"