guide How To Restore Deleted Files In Linux

[100%]

If you've unintentionally erased a file in Linux, don't worry, you can likely still recover it as long as that section of the disk hasn't been overwritten yet. This article will demonstrate how to effortlessly regain a deleted file in Linux.

Foremost has the ability to scan a disk or raw image file and retrieve files based on their headers, footers, and internal data structures.

Install Foremost

Foremost is available in numerous Linux distributions. Mint/Debian/Ubuntu

To install Foremost in Linux Mint, Debian, or Ubuntu, simply execute the following command.

This is the hidden content, please

• Sign In
• or
• Sign Up

CentOS/RHEL

Foremost is not included in the standard CentOS/RHEL repositories by default, so we'll install it directly from the RPM.

This is the hidden content, please

• Sign In
• or
• Sign Up

The above RPM is for el7, while el6 can be found here.

If these options fail, you can download the Foremost source here.

In this instance, we're using CentOS 7, but once you've installed Foremost, the remaining steps should be the same in any Linux distribution. Deleting a File

Now that Foremost is installed, let's delete a file. It's important to note that Foremost doesn't need to be installed when the file was deleted; that's just the order I happened to follow.

In this example, we'll be removing the image.jpg file shown below.

This is the hidden content, please

• Sign In
• or
• Sign Up

We'll use this information later to verify that the file has been successfully restored. Now let's delete the file using the rm command.

This is the hidden content, please

• Sign In
• or
• Sign Up

Restore a Deleted File

Next, let's create a directory where we can restore our files. Foremost requires an empty directory for this purpose, so we'll create /root/restored/.

This is the hidden content, please

• Sign In
• or
• Sign Up

Now we're ready to execute the Foremost command and restore our image file. The -i switch is used to specify the disk or image file that we want to search, while -t is used to restore files of the specified type. Foremost supports various file types; refer to the foremost man page for the complete list. This is necessary because Foremost scans the disk based on the headers specific to each file type.

This is the hidden content, please

• Sign In
• or
• Sign Up

|**************************************************************************************************************************************************************************************|

This process took approximately 2 minutes to complete on an 18GB disk. It will locate any .jpg files in /dev/sda3 and restore them to the /root/restored/ directory, as long as the space they occupy on the disk hasn't been overwritten by anything else.

If we examine the /root/restored directory, we can see that our image file has been successfully restored. The md5 hash of the file is exactly the same as it was before we deleted it.

This is the hidden content, please

• Sign In
• or
• Sign Up