[SOLVED] How to recover deleted files from a fat32 volume in Linux?

colucix · 07-12-2009, 03:35 AM

Hi all.

I accidentally deleted some precious files from an external disk formatted as fat32. I immediately unmounted the volume. Is there a way in linux (I've not a windows system at hand now) to recover the deleted files?

Thank you.

Code:

Disk /dev/sdb: 1000.2 GB, 1000204886016 bytes
255 heads, 63 sectors/track, 121601 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0xe8900690

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1      121601   976760001    c  W95 FAT32 (LBA)

syg00 · 07-12-2009, 03:44 AM

I'd probably start with photorec - does more than just photos.

tredegar · 07-12-2009, 05:57 AM

If they're really precious, the first thing I'd do is mount /dev/sdb1 as read-only.
Then image it dd if=/dev/sdb1 of=myimage
Then unmount /dev/sdb1 and unplug it.

Now mount myimage with the loop option, and then you can safely use photorec and all the other utilities to your heart's content, happy in the knowledge that if you mess up, you still have your original disk, untouched.

Good luck.

colucix · 07-12-2009, 08:55 AM

Thank you for your advices.

@syg00 - I launched photorec and it already found ~ 200 files of about 630. Estimated time left: about 11 hours. I will see tomorrow the complete results.

@tredegar - Good advice. Unfortunately I could not mirror the whole disk, because I don't have another Terabyte available. I just mounted the partition as read-only.

alan_ri · 07-12-2009, 09:22 AM

I had to do the same thing many times before and I'd say testdisk is much faster and does a great job.

Only important thing is that you haven't done anything with that disk after you have deleted files on it.

If so,testdisk will recover everything just the way it was and based on what you've said ( 11 more hours ) I think it'll do the job faster.

colucix · 07-12-2009, 09:29 AM

I didn't do anything with the disk, I immediately unmounted it. Now the estimated time left is 12h25m. I'm checking the recovered files and it looks like it's doing a good job. Since I'm not in a hurry, I prefer to leave it running (it's 16:00 now in Italy, tomorrow early in the morning it should have finished). Thank you, anyway.

alan_ri · 07-12-2009, 09:45 AM

Whatever works for you,but if you find yourself in a hurry sometime give testdisk a try.

H_TeXMeX_H · 07-12-2009, 10:07 AM

Let it be known that photorec = testdisk ... they are one and the same, and I wish they would just stick with one name.

One that I personally recommend along with photorec is foremost:
http://foremost.sourceforge.net/

You may be able to recover more with it in some cases.

alan_ri · 07-12-2009, 10:18 AM

Quote:

Originally Posted by H_TeXMeX_H

Let it be known that photorec = testdisk ... they are one and the same, and I wish they would just stick with one name.

TestDisk and PhotoRec are in one package, are both free and Open Source software and are licensed under the terms of the GNU Public License.

TestDisk is data recovery software which is designed to help recover lost partitions and make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures from digital camera memory.

TestDisk can:

Fix partition table, recover deleted partition

Recover FAT32 boot sector from its backup

Rebuild FAT12/FAT16/FAT32 boot sector

Fix FAT tables

Rebuild NTFS boot sector

Recover NTFS boot sector from its backup

Fix MFT using MFT mirror

Locate ext2/ext3 Backup SuperBlock

Undelete files from FAT, NTFS and ext2 file system

Copy files from deleted FAT, NTFS and ext2/ext3 partitions.

PhotoRec is a companion program to TestDisk.

For more safety, PhotoRec uses read-only access to handle the drive or memory support you are about to recover lost data from.

PhotoRec works with HardDisks, Cdrom, memory card (Compact Flash, Memory Stick, SecureDigital/SD, SmartMedia, Microdrive, MMC…), USB Memory Drives, DD raw image, EnCase E01 image… PhotoRec has been successfully tested with various portable media players including iPod and Digital Camera.

H_TeXMeX_H · 07-12-2009, 10:59 AM

Oh, I see, well either way they are on the same site in the same package ...

colucix · 07-13-2009, 05:11 AM

Hi. Photorec finished the job and the result is excellent! About 95% of the lost files has been recovered. You saved my day!

@alan_ri and H_TeXMeX_H: thank you for the clarification about testdisk and photorec. Indeed the two packages are strictly related: I installed photorec using Yast in Opensuse and it installed testdisk as a requirement.

Cheers!

/usr/local · 06-28-2014, 01:20 PM

Quote:

Originally Posted by tredegar

If they're really precious, the first thing I'd do is mount /dev/sdb1 as read-only.
Then image it dd if=/dev/sdb1 of=myimage
Then unmount /dev/sdb1 and unplug it.

You wouldn't do a mount to use dd. In fact, not mounting (even read-only) is the only way to ensure, data is NOT modified.

SegmentationFault · 01-24-2019, 09:56 PM

I created an account just so I could thank the people who recommended PhotoRec. I used too wide a wildcard spec when deleting old photos and wiped my entire camera card before copying it off to permanent storage. I haven't been this excited since Papa Murphy's announced $10 Tuesday 3-topping large pizzas.

Note to future visitors: If you get here like I did by searching for "recover lost photos fat32", go right now and install PhotoRec. When you get back all those lost files, be sure and donate generously.