10 tools to recover deleted files on Linux

Some distros of Linux has recycle bin such as Ubuntu which you can restore but for the majority and deleting via command-line, the deleted files seem to disappear forever and without any trace that it ever existed.
In this article, I’ve put together list of techniques and tools that can do file/directory recovery on Linux platform. But before I start listing the tools, a few common sense techniques which can make it a bit harder to delete files on your system.
For example, change rm to alias=’rm -i’. This way, every time you delete a file, the system will ask if you’re sure.  Second thing is simply to do backups.  If you don’t have tape, use a utility like rsync to copy the important directories and files to another system or partition. You can set a crontab to do this daily or even hourly. Makes restoring so much easier in case you delete something by mistake.

1. Recover – automates some steps as described in the Ext2fs-Undeletion-howto in order to recover a lost file. This utility will greatly increase your file recover rate. People who do not know how to undelete a file are encouraged to use this utility.

1. athena-delete – was written at Project Athena in response to the problem which many novice UNIX users have with accidentally deleting files they didn’t want to delete.

1. unrm – a small shell utility which can, under some circumstances, recover almost 99% of your erased data (similar to DOS’s undelete). Read carefully the FAQ file and preferably theLinux Ext2fs Undeletion Mini-HOWTO before using it.

1. gET iT i sAY – a file recovery tool for Ext2/Ext3 filesystems. Once installed, current files and newly created files from /root and /home are recovered. It allows users to recover all deleted files, recover files owned by a specific user, dump data from old file locations, and recover files of a specific type, such as text or MP3. A forensic analyzer is also provided to assist users during recovery.

1. e2undel – an interactive console tool that recovers the data of deleted files on an ext2 file system under Linux. A library that allows you to recover deleted files by name is included. e2undel does not manipulate any internal ext2 structures, and it does not require any additional tools. It should be useable without knowledge of the ext2 internal.

1. anyfs-tools – allows you to recover and convert filesystems while using minimal extra disk space. Unlike other recovery tools, anyfs-tools doesn’t copy all the files found on other disks (or partitions), but only saves information about the location of the file blocks to an external inode table. After recovery, a user may mount the damaged filesystem with anyfs and the external inode table and then interact with all recovered files with any program.

1. rfs – a shell script for creating and updating a local spare system disk. The main goal is to recover a working system after a crash quickly. In this case, “quickly” means the time it takes to reboot the machine. rfs stands for “replication of filesystems”. Like rsyncbackup, rfs is built on top of rsync.

1. e2retrieve - an Ext2 data recovery tool that works on truncated or partial filesystems. It is very useful to retrieve data when a disk from an LVM crashes. It does not repair the filesystem but extracts and copies most of the data it can from raw Ext2 data given to it.

1. findfile – a collection of tools for recovering files from filesystems with corrupted directories, allocation tables, etc. This can be useful when the partition table (or more) of a hard disk is corrupted, or when you have a memory card of a digital camera which is corrupted.

1. TestDisk – a tool to check and undelete partitions. It works with the following partitions: FAT12, FAT16, FAT32, Linux, Linux swap (version 1 and 2), NTFS (Windows NT/W2K/2003), BeFS (BeOS), UFS (BSD), JFS, XFS, and Netware.

Some of these tools are old but can still be useful.

http://www.mynitor.com/