How to Recover Deleted Files in Linux (PhotoRec, TestDisk, extundelete)

You deleted the wrong folder. It happens to everyone eventually — a mistyped rm -rf, an emptied trash, a formatted SD card. The good news: on Linux, deleted often doesn't mean gone. The bad news: every write to that disk from now on reduces your chances.

So the first step is the most important one.

Step 1: Stop using the disk immediately

When you delete a file, the filesystem only removes the pointer to it. The data stays on disk until something overwrites it. Installing recovery tools, downloading files, even system logs can overwrite exactly the blocks you need.

• Unmount the affected partition if you can: sudo umount /dev/sdX1
• If it's your root filesystem, boot from a live USB instead and work from there
• Never install recovery software onto the same disk you're recovering from

Step 2: Check the easy places first

Before forensic tools, check the obvious:

• Trash — ~/.local/share/Trash/files/ on most desktops, or open your file manager's trash
• Backups — your rsync/restic/Borg copies, Timeshift snapshots, or a sync service's "deleted files" retention
• Editor backups — Vim writes filename~ and swap files, many editors keep local history

If the file is there, you're done in two minutes. If not, bring out the real tools.

Step 3: PhotoRec — recover by file content

PhotoRec (part of the TestDisk package) ignores the filesystem entirely and scans for known file signatures — photos, documents, archives, videos. It works even after formatting:

sudo apt install testdisk
sudo photorec

The interactive menu asks for the disk, partition, and where to save recovered files. Save to a different drive — recovering onto the same disk can overwrite the very data you're carving out.

PhotoRec recovers content, not filenames: results come back as f1234567.jpg sorted into folders by type. Expect to spend time identifying what's what.

Step 4: TestDisk — when the partition itself is gone

If the problem is bigger than deleted files — a lost partition table, a partition that vanished after a bad resize — TestDisk can find and rebuild it:

sudo testdisk

Choose the disk, analyze, and let it search for lost partitions. It can write a repaired partition table back, restoring the whole filesystem with filenames intact. This is the tool that has saved more "I formatted the wrong drive" afternoons than any other.

Step 5: extundelete — filename-aware recovery on ext3/ext4

On a standard Linux ext4 partition, extundelete can restore files with their original names by reading the filesystem journal:

sudo apt install extundelete
sudo extundelete /dev/sdX1 --restore-all

Results land in a RECOVERED_FILES folder. It only works on unmounted partitions, and it only works on ext3/ext4 — not on NTFS, exFAT, or Btrfs.

The SSD caveat

On SSDs with TRIM enabled (the default on modern systems), deleted blocks may be wiped by the drive itself within minutes. Recovery odds drop sharply. This is the one case where acting fast genuinely matters more than the tool you pick.

Next time, make recovery unnecessary

The boring truth: the best recovery tool is a backup you made yesterday. A simple automated 3-2-1 backup routine turns "disaster" into "restore from last night's snapshot" — no carving, no hex dumps, no hoping.