How to Recover Deleted Files

Important: Stop Using the Disk

When a file is deleted, data remains until overwritten. Remount as read-only:

sudo mount -o remount,ro /mountpoint

Method 1: extundelete (ext3/ext4)

sudo apt install extundelete -y

sudo extundelete /dev/sda1 --restore-file /path/to/file
sudo extundelete /dev/sda1 --restore-directory /path/to/dir
sudo extundelete /dev/sda1 --restore-all
sudo extundelete /dev/sda1 --restore-inode INODE_NUMBER

Recovered files appear in RECOVERED_FILES/

Method 2: TestDisk

sudo apt install testdisk -y
sudo testdisk /dev/sda

Method 3: PhotoRec

sudo apt install photorec -y
sudo photorec /dev/sda1

Method 4: Foremost

sudo apt install foremost -y
sudo foremost -i /dev/sda1 -o /recovery/output

Prevention

• Use trash instead of rm: sudo apt install trash-cli
• Alias rm to trash (optional)
• Maintain regular backups