Ever deleted an important file? I haven’t recently done this on Linux, but when I used Windows I had a utility for recovering deleted files. Ubuntu Unleashed reported on some data recovery methods on Ubuntu, so I decided to try one of them out.
Foremost is a command line utility for finding and recovering deleted files based on their type. It was origionally developed for the US Air Force Office of Special Investigations.
How is this type of data recovery possible? When you delete a file, the data is not really overwritten. The pointer in the filesystem to the file is simply removed so the disk area can be overwritten when necessary. The more the disk is written to after the file is deleted, the larger the chance it will be overwritten and become unrecoverable.
I decided to test out Foremost in a virtual machine. First, I created some JPEG images, deleted them, and emptied the trash. Next, I shutdown the system and booted up the Ubuntu 8.04 Beta live-CD. Live-CDs don’t write to the hard disk, so they work well for data recovery.
The universe repository needs to be enabled, I did this from System->Administration->Software Sources. From the terminal I installed Foremost:
sudo apt-get install foremost
You need to know your target partition’s path to recover from it. I simply started System-Administration->Partition Editor and saw the the home partition is /dev/sda1.
Let’s recover some JPEG images:
sudo foremost -t jpeg -i /dev/sda1
This command causes Foremost to create a directory called output and put every file it can recover in. This could take a while.
Hopefully your images won’t look anything like this (they will if you are too late):
For more details on what file types you can recover, see the manpage for Foremost.
Foremost isn’t the greatest solution; it recovers every file it sees and doesn’t support very many file types. It is possible to add types to the /etc/foremost.conf file, but it doesn’t look an easy task. However, if you’ve lost a bunch of photos or documents, Foremost could be just what you need.
Enjoyed this post? 
Foremost is great. I’ve used it for a couple things.
1) recovering file from a partially damaged drive: http://suppressingfire.livejournal.com/35705.html
2) unpacking files in unfriendly archives: http://www.suppressingfire.org/~burner/evil-mods-tiff/
Great tool.
[...] Read more at Tombuntu [...]
You can recover deleted files and lost from deleted partitions with Get Back Data tools.
Get it from http://www.getbackdata.net
[...] explained fairly clearly why data recovery on ext3 partitions is difficult. I also stumbled across a guide to using foremost, and so decided to skip straight to this command-line [...]
Thank you so much! I mistakenly deleted a book I was working on and was able to recover it thanks to your how-to. Many kudo’s to you sir!
I have just shift deleted a folder containing some doc files and text files by mistake.They are very important
I have just used this command
foremost -t doc -i /dev/sda1
mohit@gmb-india-ws-3:~$ foremost -t doc -i /dev/sda1
Processing: stdin
|
I am getting this for the past half an hour,yes folder output is created and its showing audit file and a folder name doc,but they both are empty.Will it take long time?
One more question
how can i recover my text file data?…..i mean the command for that
Thanks
You probably want to specify an output folder as well, ex… foremost -t doc -i /dev/sda1 -o /home/user/recovery/
When I ran foremost, I ran it under sudo and I had to chown the files back to my login user so I could access them.
Good luck.
Hello!
.
Thanks for this info but i want to ask if you know what should I write foremost -t ???? -i /dev/sda1 if I want to recover a .conkyrc file?
I’ve tried foremost -t .conkyrc -i /dev/sda1 but it’s not working
Thanks!
Unbelievable!!! This site doesn’t support unicode standard??? Russian is not displayed properly… Stupid!!!
Vasia, try without “.”
sudo foremost -t conkyrc -i /dev/sda1
You’ll probably need an output directory also -o directory.
Create and mount “directory” before recovery. Good luck!
How do I recover a couple of specific files? I’m looking for a couple of TV shows I deleted called ‘Archer’ if I replace ‘jpeg’ with ‘Archer’ I get nothing. If I use ‘avi’, which is the file extension of a couple of hundred or more deleted movie files, it will recover more files than my total remaining hard disk space!!!!