Pages

Saturday 4 October 2014

Undelete files on Linux

I accidentally deleted pictures from SD Card from my tablet. Any android undelete applications failed to identify what I was looking for. I decided to try undelete on my elementary os and the choice was to use PhotoRec. That program recovers lost files by checking data blocks one by one against a signature database of different file types.


  • Supported file formats: video (avi, mov, mp3, mp4, mpg), image (jpg, gif, png), audio (mp3, ogg), document (doc(x), ppt(x), xls(x), html), archive (gz, zip) etc.
  • Supported file systems: EXT2, EXT3, EXT4, HFS+, FAT, NTFS, exFAT
Took most recent version:


For 32-bit Linux:

wget http://www.cgsecurity.org/testdisk-7.0-WIP.linux26.tar.bz2
tar xvfvj testdisk-7.0-WIP.linux26.tar.bz2

For 64-bit Linux:

wget http://www.cgsecurity.org/testdisk-7.0-WIP.linux26-x86_64.tar.bz2
tar xvfvj testdisk-7.0-WIP.linux26-x86_64.tar.bz2

The PhotoRec executable (photorec_static) is found in the extracted directory.

cd testdisk-7.0-WIP/
sudo ./photorec_static 

Next I selected default options. Next challenge was to find pictures that I was looking for among over 50 000 recovered files in multiple subfolders. Most of them were cached browser images and any android stuff. My pictures were large, more than 4 MB. I used find command to copy qualified files to another folder:

find . -type f -size +4M -name "*.jpg" -exec cp {} /home/lukasz/Downloads/testdisk-7.0-WIP/Recovered/Large \;

Finally all my files were in Large folder.





No comments:

Post a Comment