Foremost recommends using the –d command-line option for Linux file systems like ext2. Part of this may be due to the ext2 filesystem. Looking at the files, we can confirm that these files were recovered relatively well, though we can see some errors in the thumbnail for 00622449.jpg. Your invocation will differ depending on what you’re searching for and where you’re searching for it.įoremost is able to recover 17 of the 20 files stored on the hard drive. Sudo foremost –t jpeg,png,gif –o foremost –v –i /dev/sda This can be a disk image in several different formats however, we will use a hard disk, /dev/sda.
To start recovering files, open a terminal (Applications > Accessories > Terminal) and type in:įor a full list of options that can be tweaked via the command line, open up a terminal (Applications > Accessories > Terminal) and type in: Of the three tools we’ll show, PhotoRec is the most user-friendly, despite being a console-based utility. Note: If your Ubuntu Live CD is not persistent, then when you reboot you will have to reinstall any tools that you installed earlier.Īfter restarting, both of our partitions are back to their original states, pictures and all.įor the following examples, we deleted the 10 pictures from both partitions and then reformatted them. Testdisk informs us that we will have to reboot. We only had these two partitions, so we’ll recover them by selecting Write and pressing Enter. If TestDisk hasn’t found all of your partitions, you can try doing a deeper search by selecting that option with the left and right arrow keys. We are able to change their attributes, or add more partitions, but we’ll just recover them by pressing Enter. It also finds the two partitions we just deleted.
Amazingly, TestDisk finds this partition, though it is unable to recover it. In our case, our small hard drive has previously been formatted as NTFS. In most cases (ext2/3, NTFS, FAT32, etc.) you should select Intel and press Enter. TestDisk asks you select the type of partition table to search for. You should be able to identify the hard drive you want to recover partitions from by its size and label.
Once you make your choice, you’re greeted with a list of the storage media on your machine. If you’d like, you can create a log file, though it won’t affect how much data you recover. Start it by opening a terminal (Applications > Accessories > Terminal) and typing in: Before you start trying to recover your important files, it may be possible to recover one or more partitions on your drive, recovering all of your files with one step. If you can’t mount your hard drive, then its partition table might be corrupted. Scalpel may run better if you have an older machine with less RAM. Foremost operates on hard drives or drive image files generated by various tools.įinally, scalpel performs the same functions as foremost, but is focused on enhanced performance and lower memory usage. Testdisk includes TestDisk, which can recover lost partitions and repair boot sectors, and PhotoRec, which can recover many different types of files from tons of different file systems.įoremost, originally developed by the US Air Force Office of Special Investigations, recovers files based on their headers and other internal structures. Once the package list has reloaded, and the search index rebuilt, search for and mark for installation one or all of the following packages: testdisk, foremost, and scalpel.
To enable the repository, open Synaptic Package Manager by clicking on System in the top-left, then Administration > Synaptic Package Manager.Ĭlick on Settings > Repositories and add a check in the box labelled “Community-maintained Open Source software (universe)”.Ĭlick Close, and then in the main Synaptic Package Manager window, click the Reload button. All of the tools we’re going to use are in Ubuntu’s universe repository.