Recover deleted files easily with Photorec from the console

The other days a friend came with a serious problem. They had formatted the MicroSD on her cell phone and her photos died !!

Doing a bit of research I found an excellent application for the console. Actually there are two: Testdisk y Photorec.

Testdisk It is used to recover deleted files but especially lost partitions. Instead Photorec specializes in recovering deleted files (especially multimedia files) and does other things too.

First of all an important point: If we know that we deleted or formatted something by mistake, for no reason let us write anything on it. If it is a partition on our PC, it is best to unmount it. And if it is in the partition of our system, it is best to immediately turn off our PC and do the steps from a LiveCD.

And one more thing, to recover a deleted file you have to meet certain conditions, and sometimes it is not so easy, and it is very unlikely (for technical reasons) to recover everything.

Having said this let's start:

First things first, to install it:

sudo apt-get install testdisk (with this package install both programs).

Although both programs have a powerful and varied utility, I leave that for another post. Now we are going to focus on recovering data with Photorec.

We open the terminal

We choose the directory (if it does not exist we create it) to save the recovered files.

mkdir ./recuperados
cd ./recuperados/

Then the program:

sudo photorec (we need superuser privileges)

Knowing a little English we realize that it gives us a choice between the discs that we have inserted. Since I couldn't find my pendrive, the only thing I have is my beloved hard drive.

> [Proceed] To select it (that is, press [enter])

As you will see in this case, it gives us to choose the partition.

Then we must select > [Search] and gives us to choose the type of partition. It is not very difficult, we only have two options. To make it easy, if it is a disk or partition with Linux it is the first, if it is with another operating system or it is a pendrive, memory card or something else, it is the second (except for very strange exceptions).

We move on. Now we have two options:

Free: Only recovers files deleted in free space.

Whole: Recovers everything, whether they are deleted or not.

We just choose Free. In the next window it shows us a list of navigable folders where we can copy the files it recovers (logically it cannot be on the same device). We can choose the folder to our liking, but if in the first step we create a directory and choose it with cd It will retrieve them there, because by default it does it in the folder where we were working with the terminal. If that's correct, we press on the keyboard C and it will start saving what it finds. Moreover, during the operation it will show a list with the number of different files found.

Once finished we open our favorite file explorer and go to the folder where we recover the files to see what we find.

This program was very useful to me, and I hope it will serve you as much as it does me. And I remind you that it is impossible to recover everything.

JUST A MOMENT!!! If I only delete a 100 kb file. Do I have to copy the 500 Gb of free space from my partition to my folder to find that file ???

Very good question, and the truth is that we don't want to make the album work with pleasure.

Let's see quickly (it is very similar to the above) how to recover a single (or more files) with Testdisk.

1) We open the console

2) mkdir ./recovered

3) cd ./recovered/

4) sudo testdisk

5) We select the option Create (will create a list of files)

6) We select the disk, pendrive or the unit that is.

7) Type of partition (if you don't know which one always it is the one you choose by default.)

8) IMPORTANT: we select Advanced, the second option. The rest I recommend leaving it for advanced users.

9) We select (if applicable) the partition where the file was. Notice that at the bottom of the screen we have 5 options: Type, Boot, undelete, Image Creation, Quit. What interests us is undelete. With the left / right arrows on the keyboard we choose it and (after choosing the partition) we give it Enter.

10) Now we see a browsable file list. The files in red are the ones that are deleted and are recoverable. We look for ours and (according to the commands at the end of the window) We press C (important to keep it lowercase) to work with just that file. If there are several, we are choosing them with : and then we press C (notice the difference between upper and lower case).

11) Now we choose the directory where we save it. If we follow the steps as before mkdir and cd, we can press directly C y READY!!!

Let's go and see how the file is.

One more thing, since we are working with sudo the file is now root's. But you probably already know what to do in this case 

Now I have said everything. Enjoy it and may it be useful to you.