I am using ubuntu 17.10 and need to see a list of what files were deleted from my desktop os ubuntu.

I do not have very good linux skills and am hoping there is some recovery software that is easy to download and use. I just need to see a list of deleted files - I may not actually have to recover the files; the most important thing is seeing what files are there.

Thanks,
Gabby

This may work:

http://foremost.sourceforge.net/

There is software called extundelete which may work for you. I would first check the Ubuntu Software Center or try installing it with apt-get.

Welcome to LinuxQuestions.

It depends... How did you delete the files? If you deleted them from the file browser they should be in the trash can unless it was emptied. If you deleted the files using the command line from a terminal window recently you can check the history file. The history files saves the last 1000 commands entered by default if enabled.

Otherwise, I don't know of a another to find their names. Once deleted the name and its meta data are deleted but the contents remain on the disk until overwritten by something else. There are several tools that can try to recover data by examining bytes on the disk but continuing to use the computer lessens the chance for recovery.

I forgot about extundelete...

AFAIK, there isn't a program that will show deleted files. You either recover them or you don't. Linux file systems are not designed to easily recover deleted files. Rather than undelete programs, Linux uses file carving programs to recover deleted files.

Actually, I have an external hard drive that was formatted in linux, with files on it that all were all made in windows; after files were made in windows, they were saved on external media and then later transferred to the external hard drive. I have no problem accessing/ opening/ using the files on the external hard drive - even with the external hard drive being connected to a linux os.

But someone was using my computer and external hard drive and I think they may have deleted some of the files from the external hard drive. I need to know if any files were deleted. At the time the files may have been deleted from the external hard drive - the external hard drive was connected to a different computer I no longer have. But it would seem that if the files were deleted, they would still be on the external hard drive disk and I am hoping that recovery software can look at the external disk and tell me.

Now I have a computer with ubuntu 17.10 on it. I connect the external hard drive externally to this computer when I want to use it, though I have not deleted any files myself, ever, from the external hard drive. So I wanted to download recover software onto the ubuntu computer and see if any files were deleted from the external hard drive

I imagine I could connect it to a windows os, and use one of the many free recovery software programs out there. But I don't have a computer with windows on it. And I need to do this as soon as possible.

Thanks.

Linux reads Windows file systems. Windows does not read Linux file systems. If the external drive works in Windows, it is NTFS or fat32 format. In that case Windows tools could list the deleted files. But, just because a Linux file system can have Windows files written to it does not mean Linux has undelete tools. Yes, you could try attaching it to a Windows system and see if you can do it.

One amusing anecdote regarding downloading free Windows programs: A few days ago my Dad downloaded a program for CD ripping on a Win7 machine. The program wouldn't install unless the machine was connected to the Internet. I wonder why! Within minutes after installation, the rogue program infected the system so badly that the operating system had to be reinstalled.

So, before you just go downloading free Win software, check out what your downloading!

Windows can and will read files written in Linux.
It is NOT the OS that determines whether the files CAN be read or not. It is the drivers and the file format. It is just that, by default, Windows does not load the EXTn file type drivers, but they can be loaded.

As for recovering files, TESTDISK will list files marked as delete and recover them.


The same applies to ANY software for any OS

Thanks.

For ubuntu, I did "apt-get install testdisk" from https://www.cgsecurity.org/wiki/TestDisk_Livecd

The package uploaded properly, but does not show up anywhere on the computer. I typed 'apt-get...' in again to make sure and it stated "testdisk is already the newest version 7.0-3build1.

I also did the download: https://www.cgsecurity.org/Download_...inux26.tar.bz2

Can someone walk me through how to use either method?

Thank you!

It is a command line program, so you need to find out where it was put and run the executable.
TESTDISK is best run from stand alone USB or CD and is OS independent.
Be careful with it; it is very powerful and you can easily screw up your disk as well as recover files.
It is also a very good idea to recover the files to some other media than the one being interrogated.

I was using it just last week to recover the partition tables when a faulty partition tool screwed them up while removing Windows 10.

Thanks Dave.

1) how do I figure out where it was put? I did the search thing for ubuntu - didn't see anything.

2) I don't need to recover files - I just need to see if any files were deleted --- super important - more than I can express!!

3) If we can find it - does the executable run by itself - just click on it like w/ windows?

4) Yes, I can save it to a flash like a liveusb formatted in linux.

Please help - I would really appreciate it as this is extremely important and time sensitive.

Thank you,
Gabby

If you did this on Ubuntu, just open a terminal and type: testdisk that should open it. Or the full path is likely: /usr/sbin/testdisk

Best place to get instructions on using it is at the site you downloaded from. Scroll down that page a bit and you will see a link to a Step By Step Guide.

ok, thanks. I found the following on the page I downloaded https://www.cgsecurity.org/testdisk.pdf


"Recover deleted files
TestDisk can undelete
files from ext2 filesystem,

I see it says "ext2 filesystem". Mine is ext4. For other extensions, it says use "photorec". I see somewhere it says something about downloading libraries. Am I supposed to download a "libary" ...?

If I need to use "photorec" - I tried "apt-get install photorec" but it didn't work.

Without attaching the external hard drive - I tried 'testdisk' steps on my ubuntu 17.10. It is currently running though I am attempting to copy 1 file and picked "downloads" to store it. It says "copying, please wait...250,000 ok, 15 failed. I thought I was just trying to copy 1 file...????

----------QUESTION: is ubuntu inherently ext2 or ext4?
----------------if it is not ext2 - don't know why this 'seems to be' working.
===============================================

BUT IF I NEED TO USE PHOTOREC........
***** I'm stuck at 11.1 --- how do I get started w/ photorec? I don't think photorec is installed. I typed in the command directly below but just got error messages...

==========================================
PHOTOREC:
Running TestDisk, PhotoRec under Linux
You need to be root to run TestDisk.
cd testdisk-7.0

sudo ./testdisk_static
cd testdisk-7.0

sudo ./photorec_static

Note: If your Raid device (ie. Intel raid) is missing, run “sudo dmraid -ay” to activate it.
6
==========================================

DIRECTIONS FOR PHOTOREC:

Recovering deleted files using PhotoRec
PhotoRec doesn’t recover the original filenames or the file structure but it can recover lost files even from corrupted filesystem. PhotoRec is a signature based file recovery utility (a file carver) and may be able to recover your data
where other methods failed. Remember, you must avoid writing anything on the filesystem that was holding the data. If you do, deleted files may
be overwritten by new ones.

11.1 Start photorec
• Running TestDisk, PhotoRec or QPhotoRec under Windows
• Running TestDisk, PhotoRec under Linux
• Running TestDisk, PhotoRec under Mac OS X
6.3 Running TestDisk, PhotoRec under Linux
You need to be root to run TestDisk.
cd testdisk-7.0
sudo ./testdisk_static

cd testdisk-7.0
sudo ./photorec_static
Note: If your Raid device (ie. Intel raid) is missing, run “sudo dmraid -ay” to activate it.


11.2 Disk selection
Available media are listed. Use up/down arrow keys to select the disk that holds the lost files.
• Use up/down arrow keys to select your hard drive with the lost partition/s.
• Press Enter to Proceed.
Hint for Mac OS X: If available, use raw device /dev/rdisk* instead of /dev/disk* for faster data transfer.

11.3 Source partition selection
Choose
• Search after selecting the partition that holds the lost files to start the recovery,
35
TestDisk Documentation, Release 7.1
• Options to modify the options,
• File Opt to modify the list of file types recovered by PhotoRec.

11.4 PhotoRec options
• Paranoid By default, recovered files are verified and invalid files rejected. Enable bruteforce if you want
to recover more fragmented JPEG files, note it is a very CPU intensive operation.
• The expert mode option allows the user to force the file system block size and the offset. Each filesystem
has his own block size (a multiple of the sector size) and offset (0 for NTFS, exFAT, ext2/3/4), these value are
fixed when the filesystem has been created/formated. When working on the whole disk (ie. original partitions
are lost) or a reformated partition, if PhotoRec has found very few files, you may want to try the minimal value
that PhotoRec let you select (it’s the sector size) for the block size (0 will be used for the offset).
• Enable Keep corrupted files to keep files even if they are invalid in the hope that data may still be
salvaged from an invalid file using other tools.
• Enable Low memory if your system does not have enough memory and crashes during recovery. It may be
needed for large file systems that are heavily fragmented. Do not use this option unless absolutely necessary.

11.5 Selection of files to recover
In FileOpts, enable or disable the recovery of certain file types, for example,
[X] riff RIFF audio/video: wav, cdr, avi
...
[X] tif Tag Image File Format and some raw file formats (pef/nef/dcr/sr2/cr2)
...
[X] zip zip archive including OpenOffice and MSOffice 2007
The whole list of file formats recovered by PhotoRec contains more than 300 file families representing more than 480
file extensions.

11.6 File system type
Once a partition has been selected and validated with Search, PhotoRec needs to know how the data blocks are
allocated. Unless it is an ext2/ext3/ext4 filesystem, choose Other.

11.7 Carve the partition or unallocated space only
PhotoRec can search files
• from the whole partition (useful if the filesystem is corrupted) or
• from the unallocated space only (available for ext2/ext3/ext4, FAT12/FAT16/FAT32 and NTFS). With this option
only deleted files are recovered.
36 Chapter 11. Recovering deleted files using PhotoRec
TestDisk Documentation, Release 7.1

11.8 Select where recovered files should be written
Choose the directory where the recovered files should be written. Use the arrow keys (up, down, left, right) to navigate,
you can also use the enter key to enter into a directory.
• Dos/Windows/Os2: To get the drive list (C:, D:, E:, etc.), use the arrow keys to select .., press the Enter key
- repeat until you can select the drive of your choice. Validate with Y es when you get the expected destination.
• Linux: File system from external disk may be available in a /media, /mnt or /run/media sub-directory.
Mount your destination drive if necessary.
• Mac OS X: Partitions from external disk are usually mounted in /Volumes.
Warning: Do not store the recovered files on the source filesystem. Otherwise lost data may be overwritten and definitively lost.

11.9 Recovery in progress
Number of recovered files is updated in real time.
• During pass 0, PhotoRec searches the first 10 files to determine the blocksize. This step is skipped when
searching files from the unallocated space only, the blocksize value found in the filesystem structure is
used.
• During pass 1 and later, files are recovered including some fragmented files.
Recovered files are written in recup_dir.1, recup_dir.2... sub-directories. It’s possible to access the files even if the
recovery is not finished.

forgot to ask ... do i use testdisk or photrec?

Testdisk is the general one
Photorec looks for particular file types - pictures