Recover Deleted Files on Linux: TestDisk, ReiserFS, and Command‑Line Techniques

Why Deleted Files Can Be Restored

When a file is deleted, the operating system only marks its space as free in the file allocation table (FAT) without erasing the data, so the file’s contents stay on the disk until that space is overwritten.

How Recovery Software Works

Recovery tools scan the file allocation table and look for file headers (magic numbers) such as CAFEBABE for Java class files or 25504446 ("%PDF") for PDFs. They copy matching blocks to another storage device, allowing the user to choose which files to restore.

Device Naming on Linux

All storage devices appear under /dev/. The name encodes the device type (e.g., s for SATA/SCSI/USB/FireWire), the device role ( d for disk), and an alphabetical index ( a, b, …) followed by a partition number (e.g., sda2).

Using TestDisk for File Recovery

Install: sudo apt-get install testdisk Run with root: sudo testdisk Select a log option (Create, Append, or No log).

Choose the storage device (e.g., /dev/sda) from the list displayed.

Select the correct partition table type (Intel/MBR, EFI/GPT, etc.).

Navigate to the partition that contained the deleted files and press Enter.

TestDisk then shows a file list where deleted entries appear in red. Press c to copy a file, choose a destination directory on another partition, and repeat for additional files. After copying, exit with q and adjust permissions if needed.

Partition Table Types Supported by TestDisk

Intel – MBR, common on Windows and many Linux systems.

EFI GPT – Preferred for modern Linux installations.

Humax – Used by Humax devices.

Mac – Apple Partition Map (APM).

None – Devices without a partition table (e.g., some game consoles).

Sun – Sun-specific tables.

Xbox – Xbox partition maps.

Special Case: ReiserFS Recovery

Before attempting recovery, back up the entire partition. Then run:

reiserfsck --rebuild-tree --scan-whole-partition /dev/DEVICE

Recovered files are placed in lost+found or their original locations.

Recovering a File Still Open by a Program

If a deleted file is still open, you can either let the application resave it or extract it from RAM. Example for an MP3 opened by smplayer: lsof -c smplayer | grep mp3 Identify the process ID and file descriptor, then copy the in‑memory file:

cp /proc/10037/fd/169 ~/Music/music.mp3

Secure Deletion (Making a File Irrecoverable)

To ensure a file cannot be recovered, overwrite the disk with random data or zeros. Install the secure-delete suite:

sudo apt-get install secure-delete

srm -f ./secret_file.txt

– Securely delete a file. sfill -f /mount/point/of/partition – Overwrite free space. sswap -f /dev/SWAP_DEVICE – Wipe swap area.

Secure deletion takes longer than simply marking space as free, but guarantees that the data cannot be recovered.