Here are the common methods to recover data in Debian using extract-related tools:
-
extundelete (for ext3/ext4 filesystems)
- Install:
sudo apt-get update && sudo apt-get install extundelete
- Stop services: Stop all services accessing the target partition to prevent data overwriting.
- Unmount partition:
sudo umount /dev/sdXY (replace with your actual partition, e.g., /dev/sda1).
- Recover specific file:
sudo extundelete /dev/sdXY --restore-file path/to/deleted/file
- Recover directory:
sudo extundelete /dev/sdXY --restore-directory path/to/deleted/directory
- Preview (optional): Use
--dry-run to check recovery results before actual operation.
-
testdisk (supports multiple filesystems)
- Install:
sudo apt-get update && sudo apt-get install testdisk
- Run:
sudo testdisk
- Select disk: Choose the affected disk from the list.
- Analyze: Select “Analyse” → “Quick Search” (or “Deep Search” for more thorough results).
- List files: Navigate to the found partition and select “List” to view deleted files.
- Recover: Use “Undelete” to restore selected files to a safe location (different from the original partition).
-
photorec (companion to testdisk, for various file types)
- Install:
sudo apt-get update && sudo apt-get install photorec
- Run:
sudo photorec /dev/sdXY (specify the target partition).
- Follow wizard:
- Choose “Proceed” and select the partition type.
- Set file system type (e.g., ext4) and analysis scope (entire partition or free space only).
- Select a destination directory (on a different partition) to save recovered files.
- Wait: Recovery may take time; avoid using the disk during this process.
-
foremost (file carving tool)
- Install:
sudo apt install foremost
- Run:
sudo foremost -t all -i /dev/sdXY -o /tmp/recovered_files (replace with your partition and desired output directory).
- Check results: Recovered files are categorized by type in subdirectories under the output directory.
Key notes for all methods:
- Stop using the affected partition immediately after data loss to minimize overwriting.
- Recover files to a different partition or external storage to avoid further data loss.
- Recovery success depends on factors like time since deletion, disk usage, and whether the data was overwritten.
