How to recover the Deleted file on Ubuntu

 How to recover the Permanently (shift+delete )Deleted file in Ubuntu

Restore the Deleted Files

      Sometimes we delete the files permanently, and realize its importance to restore it.

Here is the solution

Foremost

          Foremost is a free software to recover files
            1.) Install foremost

                                       sudo aptitude install foremost

Foremost examples

Search for jpeg format skipping the first 100 blocks

                                   sudo foremost -s 100 -t jpg -i image.dd


Search for gif and pdf

                                    sudo foremost -t gif,pdf -i image.dd

Search  for office documents and jpeg files in a Unix file sys-tem in verbose mode.

                              sudo foremost -v -t ole,jpeg -i image.dd

scalpel

Scalpel to recover the Deleted file.

               A Frugal, High Performance File CarverA fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery.

1.)  Install scalpel in Ubuntu

                                   sudo aptitude install scalpel

2.) open the scalpel.conf file in gedit using the below command

                                  gedit  /etc/scalpel/scalpel.conf   

3.) Uncomment all the Lines by deleting the   ' # '

  4.) sudo scalpel "FILE"  -o  "Directory "
Where FILE is the image file (or device) and Directory is the output directory.




   5.) Run the following command in terminal to recover your data.(specify the output directory in the below command)
                 
                                scalpel /dev/sda1 -o output

           

  Photorec :

 Photorec to recover the Deleted file.

           It is the fastest utility of the three .You will find the photorec utility under the package of testdisk utility. If you don't want to mess with too much of commands , then this utility is the best for you. All you need is to type the photorec as root in the terminal/terminator .

           Select the device on which you want to operate the search operation and then it will ask you for the partition table type. Select according to yours . In my case its Intel . As soon as you select the option, it will ask you to select the file system or partition of the device disk. Then it will prompt you to the filesystem selection screen.


             * indicates the mounted partition. Select the appropriate file system. Then in the end it will ask you for the folder where you want to restore the deleted files. After selection press y to proceed. Although utilities are there to recover your file I would recommend you guys to keep a habit of using plain old delete and not “Shift+Del” because prevention is always better than cure :D:D

Facebook Blogger Plugin by Pradeesh | Techie Touch