Recover deleted files easily with Photorec from the console

The other days a friend came with a serious problem. They had formatted the MicroSD on her cell phone and her photos died !!

Doing a bit of research I found an excellent application for the console. Actually there are two: Testdisk y Photorec.

Testdisk It is used to recover deleted files but especially lost partitions. Instead Photorec specializes in recovering deleted files (especially multimedia files) and does other things too.

First of all an important point: If we know that we deleted or formatted something by mistake, for no reason let us write anything on it. If it is a partition on our PC, it is best to unmount it. And if it is in the partition of our system, it is best to immediately turn off our PC and do the steps from a LiveCD.

And one more thing, to recover a deleted file you have to meet certain conditions, and sometimes it is not so easy, and it is very unlikely (for technical reasons) to recover everything.

Having said this let's start:

First things first, to install it:

sudo apt-get install testdisk (with this package install both programs).

Although both programs have a powerful and varied utility, I leave that for another post. Now we are going to focus on recovering data with Photorec.

We open the terminal

We choose the directory (if it does not exist we create it) to save the recovered files.

mkdir ./recuperados
cd ./recuperados/

Then the program:

sudo photorec (we need superuser privileges)

Knowing a little English we realize that it gives us a choice between the discs that we have inserted. Since I couldn't find my pendrive, the only thing I have is my beloved hard drive.

> [Proceed] To select it (that is, press [Enter])

As you will see in this case, it gives us to choose the partition.

Then we must select > [Search] and gives us to choose the type of partition. It is not very difficult, we only have two options. To make it easy, if it is a disk or partition with Linux it is the first, if it is with another operating system or it is a pendrive, memory card or something else, it is the second (except for very strange exceptions).

We move on. Now we have two options:

Free: Only recovers files deleted in free space.

Whole: Recovers everything, whether they are deleted or not.

We just choose Free. In the next window it shows us a list of navigable folders where we can copy the files it recovers (logically it cannot be on the same device). We can choose the folder to our liking, but if in the first step we create a directory and choose it with cd It will retrieve them there, because by default it does it in the folder where we were working with the terminal. If that's correct, we press on the keyboard C and it will start saving what it finds. Moreover, during the operation it will show a list with the number of different files found.

Once finished we open our favorite file explorer and go to the folder where we recover the files to see what we find.

This program was very useful to me, and I hope it will serve you as much as it does me. And I remind you that it is impossible to recover everything.

JUST A MOMENT!!! If I only delete a 100 kb file. Do I have to copy the 500 Gb of free space from my partition to my folder to find that file ???

Very good question, and the truth is that we don't want to make the album work with pleasure.

Let's see quickly (it is very similar to the above) how to recover a single (or more files) with Testdisk.

1) We open the console

2) mkdir ./recurados

3) cd ./recovered/

4) sudo testdisk

5) We select the option Create (will create a list of files)

6) We select the disk, pendrive or the unit that is.

7) Type of partition (if you don't know which one always it is the one you choose by default.)

8) IMPORTANT: we select Advanced, the second option. The rest I recommend leaving it for advanced users.

9) We select (if applicable) the partition where the file was. Notice that at the bottom of the screen we have 5 options: Type, Boot, Undelete, Image Creation, Quit. What interests us is Undelete. With the left / right arrows on the keyboard we choose it and (after choosing the partition) we give it Enter.

10) Now we see a browsable file list. The files in red are the ones that are deleted and are recoverable. We look for ours and (according to the commands at the end of the window) We press C (important to keep it lowercase) to work with just that file. If there are several, we are choosing them with : and then we press C (notice the difference between upper and lower case).

11) Now we choose the directory where we save it. If we follow the steps as before mkdir and cd, we can press directly C y READY!!!

Let's go and see how the file is.

One more thing, since we work with sudo the file is now root. But surely they will already know what to do in this case 🙂

Now I have said everything. Enjoy it and may it be useful to you.


The content of the article adheres to our principles of editorial ethics. To report an error click here!.

62 comments, leave yours

Leave a Comment

Your email address will not be published. Required fields are marked with *

*

*

  1. Responsible for the data: Miguel Ángel Gatón
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.

  1.   sieg84 said

    TestDisk and Photorec, very useful, but you have to treat them very carefully.

  2.   Liamngls said

    Great programs that can save you from more than one trouble 🙂

  3.   kikee said

    It is also good that you put the official link of the program:

    http://www.cgsecurity.org/wiki/TestDisk_Download

    By the way, very good program, I have used it a couple of times to get my cousin out of trouble, who formatted the disk and lost the photos, hehe!

  4.   nonamed said

    interesting, although photorec only serves to recover multimedia files

    to recover any file of any type deleted in an ext partition we can use extundelete

    1.    Jordi Fdez said

      not true: with photorec, although its name may be misleading, you can recover all kinds of files

      1.    nonamed said

        PhotoRec is file data recovery software designed to recover lost pictures from digital camera memory or even Hard Disks. It has been extended to search also for non audio / video headers. It searches for following files and is able to undelete them:

        * Sun / NeXT audio data (.au)
        * RIFF audio / video (.avi / .wav)
        * BMP bitmap (.bmp)
        * bzip2 compressed data (.bz2)
        * Source code written in C (.c)
        * Canon Raw picture (.crw)
        * Canon catalog (.ctg)
        * FAT subdirectory
        * Microsoft Office Document (.doc)
        * Nikon dsc (.dsc)
        * HTML page (.html)
        * JPEG picture (.jpg)
        * MOV video (.mov)
        * MP3 audio (MPEG ADTS, layer III, v1) (.mp3)
        * Moving Picture Experts Group video (.mpg)
        * Minolta Raw picture (.mrw)
        * Olympus Raw Format picture (.orf)
        * Portable Document Format (.pdf)
        * Perl script (.pl)
        * Portable Network Graphics (.png)
        * Raw Fujifilm picture (.raf)
        * Contax picture (.raw)
        * Rollei picture (.rdc)
        * Rich Text Format (.rtf)
        * Shell script (.sh)
        * Tar archive (.tar)
        * Tag Image File Format (.tiff)
        * Microsoft ASF (.wma)
        * Sigma / Foveon X3 raw picture (.x3f)
        * zip archive (.zip)

        1.    Leo said

          Exact. It even recovers files with "strange" extensions.
          The biggest difference (I didria to the gross) would be that Photorec recovers "all" files, and in Testdisk you can choose them.

          Thank you all for commenting, it makes me see that my work was not in vain 🙂

  5.   @Jlcmux said

    I have a disk saved somewhere that keeps it when I accidentally delete a lot of information and I really did not know how to restore it.

    Could it be that if I try to use the time later program it will help?

    Regards.!

    1.    KZKG ^ Gaara said

      In theory yes 🙂
      No matter how long it has been since you delete the information, as long as you don't copy anything new to the HDD, you should be able to recover the data.

  6.   invisible15 said

    I used it on a 500gb HDD from which the ext4 partition was mistakenly deleted ... I'm glad I recovered almost everything (it took its hours) ...

  7.   conandoel said

    Excellent!!

    1.    Leo said

      Thank you!!! 🙂

  8.   Juanacatlan said

    Hello I am in a somewhat complicated situation, from an ultrabook, I accidentally deleted some photos that were not even mine. When wanting to download the testdisk from an ubuntu usb, it tells me that it cannot find the requested package, I already asked a friend if there was another way to install it but he told me that the live cd and usb only bring the necessary packages to test ubuntu.
    My questions are Can I install the testdisk from the hard disk where I deleted the files? If so, do I have the possibility of recovering those photos (they are about 30) one hundred percent? It should be noted that since it is an ultrabook, it does not have a cd drive and I cannot open it to remove the hard drive.

    I hope prompt response, it would get me out of trouble.

    1.    elav said

      In fact, if you run a LiveCD from a Flash memory if you can install the packages you want ... even make it persistent, that is, you restart and re-enter with the USB memory and you do not lose anything ...

      1.    Leo said

        It is true. If you use Unetbooting to create the bootable usb, it gives you the option of reserving space on it to make it permanent.
        Weird that I can't find the package Did you update the repositories before trying to download it? Do you have all the repos. activated?
        If not, there are several "rescue" distros that already bring this type of tools to use in live mode.

  9.   c4explosive said

    Very useful. I recovered several files. Thank you.

  10.   Leo said

    For those who need to have it on hand in a Live distro, in the following link to the Wiki are the distros that bring them by default.

    http://www.cgsecurity.org/wiki/TestDisk_Livecd

  11.   gabo said

    I recovered a lot of files that were left in the folder, but they are strange files, none of them contain the information that you are looking for, they are pure codes and rare images .. ayudaaaaaa

  12.   yoipokme said

    Excellent post, it helped me a lot, I didn't think it was so easy 🙂 and I use it under the win2 platform in my work, greetings.

  13.   Ictineu said

    Very good article and also the comments that complete it. I've used both several times, but I always come back to this page to jog my memory. The extundelete-0.2.4-1 did not know it, but it is already installed to test it, if with 44,0 KiB, it is capable of doing what it says I take my hat off.
    Even in the case of losing a file, if this is the price for being the boss in the system, I personally pay for it with pleasure, much better than the root of the company on duty, although sometimes the fingers go faster than the brain.
    Thanks Leo and fellow members.

    1.    Leo said

      Thanks to you for commenting. The truth is that these programs must always be kept close at hand, because one never knows when an unforeseen event may occur.

  14.   miguel ferres said

    Good afternoon brothers, I need information from you to see what I can do in my case before trying to install those programs that you recommend for data recovery ... I have a computer troja (64-bit UTECH) and I installed ubuntu 12.04 until I could download the OS rosafresh 2013 (I suffer from what they say »versionitis and distriris»,) although I don't know anything about computer science but with the tutorials found on the net, that's easy… I downloaded said Os, that's it !!! but when I look for it in »downloads» I realize that it is in a file folder that says »TEMP», I open it, and there are some text files and a folder that says »rosafresh.iso..cd raw…. I copy it to put it in »downloads» and only copy the texts and not the CD, I go back to »TEMP», and the surprise ??? I did not find it anywhere, now the million dollar question: they think you can recover, or did I lose my 1,5gb of OS download ??? waiting for your suggestions, I say goodbye ,,,,,

  15.   neox32000 said

    Something just happened to me and I don't know how to take it
    -run jdfrag on my ntfs partition -I have 3 partitions not counting swap: ext4 -linux mint-, ntfs -windows xp -, ntfs -backup-

    chkdisk was run on the backup -where it defragmented- and I screwed up everything there: I have a clean 560 gb partition; I have unmounted my ntfs partition from linux and I am trying to clone with the DD command to a 1tb usb hard disk: my doubts are:
    1) dd can clone byte by byte? -This is with the parameters of blocks with less than 1 mega-let's say 254k- to be able to clone my partition to the usb driver and from there make the backup?
    2) I need to recover the information with the directories - it is useful to recover the mp3s, but I have many things distributed in folders for various reasons

    1.    Leo said

      Have you tried to run photorec directly on the partition you screwed up? (obviously without mounting it). I think it is not necessary to clone the partition to an external disk, but this disk will be very useful to send everything that the program will recover (I wish you luck to be a lot), especially you will benefit from at speed. Remember that it is impossible to recover 100% of the files, especially in ntfs partitions that are usually very fragmented.

      1.    Oswil said

        Hi Leo, sorry for the inconvenience, but as a super-newbie in this Linux I am always bothering many ... Below I left a comment about my concern, if you can help me, I would be grateful brother ...

  16.   Jorge Flores said

    since photorec recovered files with a different name that original and the name was very important, took the raid to a specialized company, but they couldn´t recover any data, they claim the disk were empty, how can that happened? my guess is photorec deleted the records after recovered.

    does anyone happened same?

    KR

    1.    Manuel de la Fuente said

      Photorec does not delete anything, your company lied to you. To recover files with the original name there is TestDisk, although the times I have used it it has not been of any use to me. You can also use a Windows program called Recuva, it is the one with the best results I have seen, but it is not infallible either

      1.    elav said

        I highly doubt that they will answer this comment. I think it's a bot or something, or the email address you put in doesn't exist. Even Akismet had deleted / locked it.

        1.    Manuel de la Fuente said

          Hahaha, I thought so when I saw that he writes in English but his name is Jorge Flores and he has an IP from Mexico. 😀

          Although before answering I searched for your comment on Google and there were no results; when they are bots the same comment appears on many pages. And it didn't include any links, so if it's a bot it's a very rare one. : S

      2.    Leo said

        So a Both. I had even believed it. The truth is that it surprises me that he talks about it so coherently despite being a robot.

    2.    Leo said

      Attempt to answer in English:
      I do not know much English, but do not think so. I had when I had to recover photos files and I did it twice and both times I recovered the same amount of files. If the hard disk was damaged, perhaps completely broke to make the effort to read the entire disk retrieving all data.
      Greetings!

      1.    Manuel de la Fuente said

        He is from Mexico, you can speak to him in Spanish. 😛

  17.   marily said

    Hello:

    To recover deleted photos, which is the best?

    Thank you

  18.   Oswil said

    I wanted to install Photorec using Synaptic on Debian Wheezy and I got 2 files from TeskDisck, I installed them, hoping it was the application with a graphical interface, but, I don't see it anywhere, not even after restarting the lap-top … What would be the way to proceed in this case?
    Thank you very much to anyone who can guide me ...

    1.    Leo said

      Hello! Unfortunately I no longer use Debian (I switched to OpenSuse), so I can't help you much, I know there are several graphical applications but they are limited, but I never installed any and didn't look for them. If you need something effective I recommend that you do it by console. You can still search for something on the Internet.

  19.   Mariano said

    Thank you very much, very useful, direct to print and folder of machetes.
    Greetings.

  20.   kalimba said

    You know I installed Kali on my computer and I accidentally lost some files, how can I recover them?

  21.   kalimba said

    eye I am a newbie in this of the compus, if someone could help me

  22.   adolfo said

    hey a question, is it normal that when you finish making a recovery with this program, and the result is some files that I can't copy or move to another place? they just stay there in the recovery folder, and the icons of the files they have a lock. How can i fix that? help me please, and thank you, your post is very good,

    1.    Leo said

      Yes, it is normal because you ran the program as root, and as a normal user you will not be able to modify it or do anything.
      Solution: run the file manager as root from the terminal, eg:
      sudo dolphin
      Go to the folder and change the permissions so that all users can modify the files.
      It is easy. Regards.

      1.    Juan said

        A query does not show me the linux partition, I am on Ubuntu 10.4.
        Thanks in advance.-

  23.   Anonymity said

    Thank you for this post. I am using Linux Mint for the first time and I was trying to make a shortcut, I thought I had done it and I deleted the folder, and it turns out that I had not made a shortcut but moved it, so I have deleted the original folder! I have realized it almost instantly and it almost gives me something, I quickly googled and I have arrived here.

    I have copied all those commands to the console (the first time I use the console) and right now it is recovering! It says that it already has 3000 txt, 1900 pdf, 1200 doc, 1300 jpg, etc.
    So it works great. Thank you very much again, and thank you for posting with explanations, images and commands, and not doing video-tutorials that are a hassle to watch.

    1.    Leo said

      I am very glad that it serves you. I see you are new to Linux, I wish you the best of luck.
      Greetings!!

  24.   The Yerbas said

    Well after reading the tutorial and all the comments, in case there was the answer I was looking for, I ask the question, since I did not find the answer.
    Did I accidentally delete some videos (gameplays) from my pc, some of the videos occupy 15 gb, in total they were 150 gb, I record with a program called actión, and from that same program I was deleting the videos that I did not need, which was my Surprise that when wanting to delete a video, all the ones I had disappeared, I suppose that instead of clicking the button to delete the selected file, I gave him to delete all the files,
    I have used this program and I realize that the videos it recovers do not occupy more than 1,86 gb (several videos with the same size) and 954 Mb also several videos, it is strange because the videos did not have the same weight, each one had a different size.
    The program to recover all the videos has just finished and it turns out that the size of the video does not matter, all the recovered videos are only seen for the first 2 minutes, any solution or any other program to recover large videos?
    I have a YouTube channel called El yerbas

    1.    Maria Fernanda said

      Hello, the same thing happened to me.
      Could you solve the problem? It is urgent for me to solve it.
      Help please!

  25.   Maria Fernanda Rios said

    Hello, when I was downloading the material from my SD the computer generated an error and when I looked there was nothing on the card, obviously I had not finished passing the material and it was deleted. The material is photos and videos.
    I went through Photorec and it recovers the photos and the videos, the files come out, but when I go to play them I don't see the image or the sound.
    Could you please help me?
    I need to save the material, please !!
    🙁

  26.   Princess41 said

    If it retrieves info but I think it is pure files that have nothing, what interests me to know if someone can help me recover .sql files from a database that are automatically generated with crontab please

  27.   Mika said

    Excellent contribution, but at the time of recovering my files it does not have an extension and it has a generic name, is there a way to identify the extension of each one?

    1.    Leo said

      I doubt it. Remember that any software to recover files does its best to read them without having an "index", which is why in most cases names and extensions are lost and many are corrupted. Many file managers identify them without the need for an extension and may even show you previews of the videos or photos. Have you tried exploring the recovered files with Dolphin? It has helped me.

      1.    Mario alanis said

        hello a favor you will have the dolphin program league, thank you !!!

  28.   alice123 said

    Hi ,,, you can also now recover your deleted files like photos, videos or music files etc. using other data recovery software such as card data recovery software. This recovery software can easily recover deleted filed of any type of memory in few steps. Follow the link below in order to make use of this software:
    http://es.carddata-recovery.com

  29.   ssor_e said

    Hello, before I had windows installed, now I switched to ubuntu and thanks to photorec I managed to rescue many things, but does anyone know if the passwords that I had saved in google chorme can be rescued?

  30.   Leo said

    Use the same account you had? I think it's the only option

  31.   ANIMETALERO said

    HEY FRIEND !; WILL IT WORK FOR ANDROID PHONES ?; IN THEORY IT COULD WORK, SO I WILL TEST THEM AND TELL YOU THE RESULTS ...

    I WILL ALSO TEST SOME APPLICATIONS OF THE CHANGOS OF «LAS VENTANAS» OF THE CUATE «BILLY PUERTAS» WITH WINE AND / OR PLAYONLINUX AND I WILL TELL YOU THE RESULTS ...

    IT IS IRONIC BEING “THE ANDROID” AND “THE PENGUIN” GNU / UNIX-BASED COUSIN-BROTHER OPERATING SYSTEMS OF MASTERS RICK STALLMAN AND LINUS TOVARLDS, SOMETIMES THERE IS NOT A LOT OF COMPATIBLITY ...

    I'M WITH UBUNTU 12 DEL PANGOLÍN AND 14 DEL CARNERO ...

  32.   Javier said

    ERROR SAVED A .DOC IN TMP AND I CAN'T GET IT

  33.   Luis said

    Thank you very much, this program recovered almost 20 GB in photos and videos that I thought were lost

  34.   Ronaldo Rodriguez said

    Undelete does not come out. I have Ubuntu 14.04

  35.   Nico said

    Hi, I'm Nico, a question I recovered a number of videos and other files, but I had great interest in recovering a significant amount that I had of Midis and Kars files or karaokes, but I have replaced the name with a series of numbers with which it is very Its use is difficult because you never know what song it is, is there a possibility of recovering these files with their original name? thanks

  36.   Fernando said

    Good morning, I have a question, because the photos are not recovered in their original size but in small size and when enlarged they look blurry, please someone help me with that issue. Thank you

  37.   Mario alanis said

    When using photorec I gave it to search the entire disk for 320 gb, and in options I gave it only some of the ones I need, however the process is taking up to 200 hrs, is it normal? any recommendation, thanks !!!

  38.   mario cabrera said

    If I recover files, but they cause me too much weight, how can I delete them?

  39.   Omar belly said

    I already read the article, I don't know much about the terminal but I understood something. I hope someone explains it to me with apples. Beforehand thank you very much. Erase hard drive by mistake (A) I want to recover the files on the hard drive (B) because my laptop does not have much capacity to recover the deleted files. How do I get him to copy them to the hard disk (B). Thanks