How to recover deleted files under GNU/Linux

By mystake, I called rm on a complete directory and the result is awful and predictable : all files were correctly deleted. Just after, I searched for a solution.

Install needed package

We will use a free and open source software licensed under GPL v2+ called TestDisk.

First, install the testdisk package using your distribution's package manager. On debian-based systems :

sudo apt install testdisk

or on arch-based distributions such as manjaro :

sudo pacman -S testdisk

Gathering informations

Before starting the restoration process, you'll need some informations :

The df -m command can help you find this information from the mount point the deleted file was on :

Filesystem     1M-blocks  Used Available Use% Mounted on
udev                4949     0      4949   0% /dev
tmpfs                999    10       990   1% /run
/dev/sda1          23339 10168     11963  46% /
tmpfs               4993   173      4820   4% /dev/shm
tmpfs                  5     1         5   1% /run/lock
tmpfs               4993     0      4993   0% /sys/fs/cgroup
/dev/sda5           9323  2068      6762  24% /var
/dev/sda8         874980 49408    781058   6% /home
/dev/sda7          15081    10     14288   1% /tmp

So, if the deleted file was in /home directory, the partition is /dev/sda8.

• The used disk and partition (the same device name that below, followed by a number, e.g. /dev/sda7).;
• The type of filesystem (ext2, ext3, etc...). Running the  lsblk -f command;
• Create a new directory used for the restauration;

Running photorec

The program we'll use, a terminal-based tool named photorec, need  the superuser privilleges. It is part of the TestDisk suite we installed it in the previous step :

sudo photorec

It will ask you some questions about the incident as the disk and the partition where the deletion occured and will finally try to recover the deleted files. The key here is to be as fast as possible to avoid file system modification and obviously : DO NOT REBOOT!. Try this solution as soon as you discover your mistake. Good luck.

photorec : the disk selection screen

photorec : partition selection