How to recover deleted files in Ubuntu/Linux

When a file is deleted, only the pointer to the file is overwritten and the original file will still reside in the blocks of the storage device and will be kept there until it is overwritten by another file. In a sense, you can always write a file but you can never delete it. So if you have ever faced the dilemma of trying to recover a deleted file in Ubuntu then look no further. Linux offers a wide range of tools for recovering deleted files. These tools work by retrieving the pointer to the deleted files.

The chief among the recovery tools would be Scalpel. Scalpel is a platform independent command based tool which is small yet very powerful. You can install the latest version of Scalpel (version 2.0) by doing a simple

sudo apt-get install scalpel 

in the terminal.

After installation you need to go to the configuration file of scalpel which resides in

/etc/scalpel/scalpel.conf

Using an editor like gedit open the scalpel.conf file using the command.

sudo gedit /etc/scalpel/scalpel.conf

You will notice that that all the lines in the file are preceded by a comment (#) symbol. Remove the # symbol preceding the file you want to recover.

sudo scalpel "device name/Directoryname/file name" -o "output directory"

The output directory is the directory where you want to restore your deleted files. It should be empty before running the command, otherwise you will get an error. You can also input the deleted filename directly by using -i option.