Select the directory you deleted the file in, mine was in ~/Downloads.

For this part, I would select free to scour the free-space, or you could use the whole disk, it doesn't really matter.

Now select your home partition, mine is installed on /dev/sda3.

Select the hard drive that you will be recovering from.

After that's all set, open up a terminal and let's run the tool and recover it! Now, open up a file manager, or a terminal and delete the file you would like to practice recovery on. I chose this one of Tux, the Linux mascot! Step 2 Delete a File and Recover Itįor this example, we should set up a file or picture that we want to have deleted. Let's move on to the simulation of a lost file and its recovery. Step 1 Download TestDisk + PhotoRecĪll commands in bold are terminal commands. Let's set up a test environment and get started.

For this guide, I will be running the tools under Arch Linux. Today in Null Byte, we are going to be using the data recovery tool suite TestDisk + PhotoRec to carve files from our disk that we have deleted. When files are deleted from a disk, they are simply modified in binary to tell the computer that those files can be written over. I personally use ext4 file system because it's the latest and greatest ext-journaling system and supports a large level of directory recursion and file sizes, but most installations still use ext2 or ext3. Windows uses NTFS, or FAT file systems, while on the other hand, Linux uses ext-based file systems. It requires different software than the Windows counterparts because every OS has their own file system.

File recovery on Linux is a bit different than Windows.

Testdisk recover files ext4