LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 07-12-2009, 03:35 AM   #1
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
How to recover deleted files from a fat32 volume in Linux?


Hi all.

I accidentally deleted some precious files from an external disk formatted as fat32. I immediately unmounted the volume. Is there a way in linux (I've not a windows system at hand now) to recover the deleted files?

Thank you.

Code:
Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xe8900690

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1      121601   976760001    c  W95 FAT32 (LBA)
 
Old 07-12-2009, 03:44 AM   #2
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 12,271

Rep: Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028Reputation: 1028
I'd probably start with photorec - does more than just photos.
 
Old 07-12-2009, 05:57 AM   #3
tredegar
LQ 5k Club
 
Registered: May 2003
Location: London, UK
Distribution: Debian "Jessie"
Posts: 6,012

Rep: Reputation: 367Reputation: 367Reputation: 367Reputation: 367
If they're really precious, the first thing I'd do is mount /dev/sdb1 as read-only.
Then image it dd if=/dev/sdb1 of=myimage
Then unmount /dev/sdb1 and unplug it.

Now mount myimage with the loop option, and then you can safely use photorec and all the other utilities to your heart's content, happy in the knowledge that if you mess up, you still have your original disk, untouched.

Good luck.
 
Old 07-12-2009, 08:55 AM   #4
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Original Poster
Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Thank you for your advices.

@syg00 - I launched photorec and it already found ~ 200 files of about 630. Estimated time left: about 11 hours. I will see tomorrow the complete results.

@tredegar - Good advice. Unfortunately I could not mirror the whole disk, because I don't have another Terabyte available. I just mounted the partition as read-only.
 
Old 07-12-2009, 09:22 AM   #5
alan_ri
Senior Member
 
Registered: Dec 2007
Location: Croatia
Distribution: Debian GNU/Linux
Posts: 1,733
Blog Entries: 5

Rep: Reputation: 127Reputation: 127
I had to do the same thing many times before and I'd say testdisk is much faster and does a great job.

Only important thing is that you haven't done anything with that disk after you have deleted files on it.

If so,testdisk will recover everything just the way it was and based on what you've said ( 11 more hours ) I think it'll do the job faster.
 
Old 07-12-2009, 09:29 AM   #6
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Original Poster
Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
I didn't do anything with the disk, I immediately unmounted it. Now the estimated time left is 12h25m. I'm checking the recovered files and it looks like it's doing a good job. Since I'm not in a hurry, I prefer to leave it running (it's 16:00 now in Italy, tomorrow early in the morning it should have finished). Thank you, anyway.
 
Old 07-12-2009, 09:45 AM   #7
alan_ri
Senior Member
 
Registered: Dec 2007
Location: Croatia
Distribution: Debian GNU/Linux
Posts: 1,733
Blog Entries: 5

Rep: Reputation: 127Reputation: 127
Whatever works for you,but if you find yourself in a hurry sometime give testdisk a try.
 
Old 07-12-2009, 10:07 AM   #8
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
Let it be known that photorec = testdisk ... they are one and the same, and I wish they would just stick with one name.

One that I personally recommend along with photorec is foremost:
http://foremost.sourceforge.net/

You may be able to recover more with it in some cases.
 
Old 07-12-2009, 10:18 AM   #9
alan_ri
Senior Member
 
Registered: Dec 2007
Location: Croatia
Distribution: Debian GNU/Linux
Posts: 1,733
Blog Entries: 5

Rep: Reputation: 127Reputation: 127
Quote:
Originally Posted by H_TeXMeX_H View Post
Let it be known that photorec = testdisk ... they are one and the same, and I wish they would just stick with one name.
TestDisk and PhotoRec are in one package, are both free and Open Source software and are licensed under the terms of the GNU Public License.

TestDisk is data recovery software which is designed to help recover lost partitions and make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures from digital camera memory.



TestDisk can:
  • Fix partition table, recover deleted partition
  • Recover FAT32 boot sector from its backup
  • Rebuild FAT12/FAT16/FAT32 boot sector
  • Fix FAT tables
  • Rebuild NTFS boot sector
  • Recover NTFS boot sector from its backup
  • Fix MFT using MFT mirror
  • Locate ext2/ext3 Backup SuperBlock
  • Undelete files from FAT, NTFS and ext2 file system
  • Copy files from deleted FAT, NTFS and ext2/ext3 partitions.
PhotoRec is a companion program to TestDisk.
  • For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from.
  • PhotoRec works with HardDisks, Cdrom, memory card (Compact Flash, Memory Stick, SecureDigital/SD, SmartMedia, Microdrive, MMC…), USB Memory Drives, DD raw image, EnCase E01 image… PhotoRec has been successfully tested with various portable media players including iPod and Digital Camera.
 
Old 07-12-2009, 10:59 AM   #10
H_TeXMeX_H
Guru
 
Registered: Oct 2005
Location: $RANDOM
Distribution: slackware64
Posts: 12,928
Blog Entries: 2

Rep: Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269Reputation: 1269
Oh, I see, well either way they are on the same site in the same package ...
 
Old 07-13-2009, 05:11 AM   #11
colucix
Moderator
 
Registered: Sep 2003
Location: Bologna
Distribution: CentOS 6.5 OpenSuSE 12.3
Posts: 10,498

Original Poster
Rep: Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956Reputation: 1956
Hi. Photorec finished the job and the result is excellent! About 95% of the lost files has been recovered. You saved my day!

@alan_ri and H_TeXMeX_H: thank you for the clarification about testdisk and photorec. Indeed the two packages are strictly related: I installed photorec using Yast in Opensuse and it installed testdisk as a requirement.

Cheers!
 
Old 06-28-2014, 01:20 PM   #12
/usr/local
LQ Newbie
 
Registered: Nov 2011
Location: Hamburg, Germany
Distribution: Debian, Ubuntu
Posts: 8

Rep: Reputation: Disabled
No use of mount if using dd

Quote:
Originally Posted by tredegar View Post
If they're really precious, the first thing I'd do is mount /dev/sdb1 as read-only.
Then image it dd if=/dev/sdb1 of=myimage
Then unmount /dev/sdb1 and unplug it.
You wouldn't do a mount to use dd. In fact, not mounting (even read-only) is the only way to ensure, data is NOT modified.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
i need a bootable linux cd to recover deleted windows files french_berg Linux - Newbie 20 03-17-2010 04:17 AM
LXer: Recover Deleted Linux Files With lsof LXer Syndicated Linux News 0 06-05-2009 07:51 PM
Software to help me recover 'Deleted' FAT32 Partition Data? flamesrock Linux - Software 8 07-26-2005 10:39 PM
recover deleted windows files from linux(help) rkrishna Linux - General 2 06-22-2005 11:32 AM
recover deleted files on fat32/ntfs partitons? niteshadw Linux - Software 1 04-21-2005 10:23 AM


All times are GMT -5. The time now is 08:52 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration