Recovering deleted files using testdisk
Welcome back, In this blog we are going to see how to recover deleted files using “testdisk”.
Sorry for changing the topic from previous blogs, I hope you will find this helpful.
Testdisk is used to Scan and repair disk partitions. It can check and repair most partition types, also it can undelete files from
— DOS/Windows FAT12, FAT16 and FAT32
— Linux ext2
Lets get this started.
First we can install testdisk in our machine,
In debian-based distributions, use
sudo apt-get install testdisk
In arch-based distributions, use
pacman -S testdisk
This will get testdisk installed in your machine
Next we can try to recover a deleted file from a pendrive using testdisk.
Notice the file called data-backup, we can mimick its deletion and try to recover it.
We can delete the data-backup file intentionally and proceed to recover the file.
We can see that the file is permanently deleted from the filesystem.
Now lets move on and see how to recover that deleted file.
We can start testdisk using the testdisk command in the terminal.
when testdisk command is typed in the terminal, it opens the interface as seen above.
If testdisk is run as root, it will directly show you the above screen, else it automatically, reruns using sudo prompting for the password, just type in the password and you are free to proceed.
Select the Create Option and press Enter.
Now select the disk from which the file is to be recovered and Select the Proceed option and Press Enter.
testdisk automatically detects the partition table type of the device(pendrive or the harddisk), if you are not sure about this thing just press Enter. Else if you know stuff, just play around with it.
Then select Advanced Filesystem Utilities to use the undelete feature and press Enter.
Make sure the selected partition is right and select the Undelete option at bottom and press Enter to proceed.
After selecting undelete, testdisk highlights all deleted files in RED color.
Now choose the file to recover using the Arrow keys and press c to copy the file.
Now testdisk asks us to select a location to save the file. Use the arrow keys to navigate the filesystem and press c to save the file in the selected location.
If the file is copied successfully, it is indicated as shown above in the picture.
We can see the file is completely recovered along with the log file of the testdisk session.
As you saw it is this easy to recover a deleted file using testdisk. I hope you found this tutorial helpful.
Testdisk is capable of doing a lot more than this and I suggest you to play around with it and explore its capabilities. You are always welcome to use the
--help option, and the man pages to know more or you may find countless tutorials like this all over the internet.
Thanks for reading and I hope you learned something new.