If you use Linux and you need to recover a deleted file, then your best bet is with a Linux live CD, such as Rescatux.
Linux live CDs are a wonderful invention, they let you try new distros, show Linux off to your unenlightened friends, and fix broken systems. There are live distros aimed specifically at repairing damaged systems, but they have a common drawback. They all require a certain amount of expertise and most of us don't break our systems often enough to gain that sort of experience.
You accidently delete an important file your main priority is fixing it as quickly as possible, not spending time using a search engine from a live CD to try and find the correct solution to your problem.
Rescatux boots like a typical live CD to a lightweight LXDE desktop, but the window that opens on startup is the key difference. Called Rescapp, this is a one-stop centre for fixing various problems. Rather Many system recovery operations require you to be booted from a live CD, either because normal booting is broken or because you need your root filesystem to be unmounted.
You normally also need to use command line tools, and Rescatux provides all of this, but the Rescapp makes life much easier for many tasks.
When you press any of the operation buttons in Rescapp, it does not directly perform the operation. It displays a documentation page explaining how to use the option and, considering the low-level aspect of many of the operations, it's a good idea to read this. Then press the Run! button at the top right to perform the operation.
Recovering deleted files in Linux
It is both amazing and terrifying how a simple typing mistake can cause so much damage. There is the odd filesystem-specific tool for recovering deleted files, such as extundelete – but a really determined typo can easily beat that, and it can't help if your partitions are gone.
The first thing to do in such a situation is to stop writing to the disk – if the damage is on the partition containing your root filesystem you should shut down the computer with
sudo shutdown -n
This kills processes without using the usual init system, which reduces the number of disk writes. Now you can boot Rescatux. If you partitioned a drive, you can use testdisk to search for the old partition boundaries and restore them.
Repartitioning a drive only writes to the partition table, the actual data on the rest of the disk isn't touched until you format the new partitions. So if you can find the old partition boundaries and write them back into the partition table, everything should be back as it was.
This is what testdisk does. After accepting the option to create a log file, that may be useful later, pick the disk to scan. The partition type should be Intel for the old-style MBR partition tables or EFI GPT for the newer GPT variant, the other choices are rather specialist.
Removable drives occasionally use the None option, but usually have a single partition with an MBR partition table. Select Analyse to scan the disk's partition table and then Deeper Scan to search for lost partitions. If you find what you are looking for, Write will hopefully restore your lost settings.
Although it is not mentioned in all the menus, pressing Q usually takes you back to the previous menu. Testdisk is a very low-level tool, and its effects may not be reversible, where possible use dd to make a backup of your disk before proceeding.
If you deleted files rather than partitions, the tool you want is PhotoRec. PhotoRec scans the disk for evidence of files and then attempts to reconstruct them – you will need another disk attached for saving these files to. PhotoRec can only find the contents of files, metadata such as ownerships, permissions and even the file name is not available to it.
So you end up with a lot of files with numeric names, although PhotoRec does give them a suitable extension based on the contents of the file. If the files are digital camera photos (PhotoRec was originally written to recover files from an erased memory card) or music files, you should find that any EXIF or ID3 tagging is preserved, making identification of the files relatively simple.
Otherwise, you may have to spend some time trawling through the files to identify them, but that is better than losing your data altogether.
