How to Recover Deleted Files on Linux with TestDisk and Command‑Line Tools

When a user accidentally deletes a needed file, most systems only mark the space as free, so the file can often be recovered.

File systems use a File Allocation Table (FAT) to track where file data resides on storage devices such as hard drives, SD cards, or flash drives.

Upon deletion, the FAT entry is either marked as free or removed, allowing the operating system to reuse that space for new files; once overwritten, the original file is permanently lost.

Therefore, after a deletion you must avoid writing any new data to the disk.

How Recovery Software Works

Most file systems simply flag space as empty. Recovery tools scan the FAT, locate the deleted file’s data, and copy it to another storage unit. They also search for file “magic numbers” at the file header, such as the Java class magic number CAFEBABE or the PDF magic number 25504446 ("%PDF").

If a file is partially overwritten, the recovered file may be corrupted and unusable.

Device Naming

All devices appear under the /dev/ directory. The first letter indicates the storage type (e.g., s for SATA, SCSI, FireWire, or USB), the second letter d stands for disk, and the following letters/numbers denote the device order and partition (e.g., sda2 is the second partition on the first SATA disk).

Using TestDisk for Recovery

TestDisk is an open‑source tool available on Linux, BSD, macOS, DOS, and Windows. Install it with sudo apt-get install testdisk and run with sudo testdisk .

When launched, TestDisk asks whether to create a log file. Choose the appropriate option, then select the storage device (e.g., /dev/sda) and its partition table type (Intel/MBR, EFI GPT, etc.).

Navigate to the list of files; deleted files appear in red. Highlight a deleted file and press c to copy it to a destination directory (preferably on a different partition). After copying, adjust permissions if necessary.

Supported Partition Table Types

Intel – Common MBR partition table used by Windows and many Linux systems.

EFI GPT – Recommended for modern Linux installations; supports multiple OS booting.

Humax – Used by Humax devices.

Mac – Apple Partition Map (APM) for older Apple hardware.

None – Devices without a partition table (e.g., some game consoles).

Sun – Sun system partition table.

Xbox – Xbox-specific partition map.

Special Case: ReiserFS

To recover files from a ReiserFS partition, first back up the entire partition, then run:

reiserfsck --rebuild-tree --scan-whole-partition /dev/DEVICE

Recovering an Open‑Deleted File

If a deleted file is still open by a program, its in‑memory copy can be saved.

For example, to locate an MP3 file opened by smplayer: lsof -c smplayer | grep mp3 Then copy it from the process’s file descriptor:

cp /proc/10037/fd/169 ~/Music/music.mp3

Secure Deletion (True Deletion)

To ensure a file cannot be recovered, overwrite the storage with meaningless data using tools such as secure-delete:

sudo apt-get install secure-delete

srm

– Permanently delete a file (e.g., srm -f ./secret_file.txt). sfill – Overwrite free space ( sfill -f /mount/point/of/partition). sswap – Erase swap space ( sswap -f /dev/SWAP_DEVICE).

Secure erasure takes longer than simply marking space as free, but guarantees that deleted data cannot be recovered.

In summary, even after emptying the recycle bin, modern operating systems still provide a chance to recover mistakenly deleted files, provided you act quickly and follow proper recovery procedures.