File recovery is a crucial skill for any Linux systems engineer. Whether due to accidental deletion, system crashes, or corruption, losing important files can be disastrous. Fortunately, Linux offers several tools and techniques for recovering lost data. This article will guide you through the process of recovering deleted files in a Linux environment, using practical examples and commands.

Examples:

1. Using extundelete for ext3/ext4 Filesystems:

   extundelete is a utility that can recover deleted files from ext3 and ext4 filesystems. Here’s how to use it:

   • Step 1: Install extundelete:

     sudo apt-get install extundelete

   • Step 2: Unmount the Filesystem: Before running extundelete, ensure the filesystem is unmounted to prevent further data loss.

     sudo umount /dev/sdX1

   • Step 3: Recover Deleted Files: To recover all deleted files, use:

     sudo extundelete /dev/sdX1 --restore-all

     To recover a specific file, use:

     sudo extundelete /dev/sdX1 --restore-file path/to/deleted/file

2. Using testdisk for Various Filesystems:

   testdisk is a powerful tool that can recover lost partitions and make non-booting disks bootable again. It also works for various filesystems.

   • Step 1: Install testdisk:

     sudo apt-get install testdisk

   • Step 2: Run testdisk:

     sudo testdisk

   • Step 3: Follow On-Screen Instructions: Use the arrow keys to navigate and select the appropriate options to analyze the disk and recover the lost files.

3. Using photorec for File Carving:

   photorec is a companion tool to testdisk and specializes in file carving, which means it can recover files based on their headers, footers, and data structures.

   • Step 1: Install photorec:

     sudo apt-get install testdisk

   • Step 2: Run photorec:

     sudo photorec

   • Step 3: Select Disk and Partition: Choose the disk and partition from which you want to recover files.

   • Step 4: Choose File Types: Select the types of files you wish to recover (e.g., jpg, pdf, txt).

   • Step 5: Start Recovery: Follow the prompts to start the recovery process.

4. Using debugfs for Advanced Users:

   debugfs is a file system debugger that can be used to manually recover files from ext2, ext3, and ext4 filesystems.

   • Step 1: Open debugfs:

     sudo debugfs /dev/sdX1

   • Step 2: Locate Deleted Files: Use the lsdel command to list deleted inodes.

     debugfs: lsdel

   • Step 3: Recover Files: Use the dump command to recover files by their inode number.

     debugfs: dump <inode_number> /path/to/recovered/file