2

Is it possible to find files that have been deleted and the trash is empty?

My desktop was cleaned out and I am not sure why, but it had some files I would like to recover.

Braiam
  • 67,791
  • 32
  • 179
  • 269
  • 1
    For such an important question, I think you provide very little information. "desktop was clean out?" Elaborate. – Jo-Erlend Schinstad Dec 07 '11 at 18:36
  • Hi Jo-Erland Schinstad ... I was playing around with banshee trying to get access to my music on laptop which runs Vista ... I finally got it too work then I rebooted and as the machine was going through the reboot I noticed that the files I had on my desktop, were all gone and that my desktop was empty. On reboot it turns out that all of the files I had on my desktop were indeed gone and my trash was empty since I had emptied it before I rebooted. That is when I cast around to see if I could recover one file in particular, my notes, but to no avail ... I did have a backup from 11/8/2011. – railguage48 Dec 08 '11 at 13:54

2 Answers2

5

Maybe...

I suggest you give extundelete a try. (Assuming that you use an ext partition)

extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!

As the site warns, the more writes to the filesystem, the less likely you'll get any files. You probably want to unmount your partition immediately and then run the program.

user606723
  • 1,802
  • Hi @user606723 .... thanks ... i will have to do some research since I am not sure how to unmount my partition. I have Ubuntu installed alongside of windows vista using Wubi. – railguage48 Dec 07 '11 at 18:17
  • Wubi you say, in Wubi the File system is not a physical part of the disk, it's a file, i wonder if it'd work despite that. – Uri Herrera Dec 07 '11 at 18:32
  • Hi Uri Herrera .. thanks for your reply .... I guess I will give it a try. – railguage48 Dec 07 '11 at 18:42
1

Files that had been emptied from Trash may have been overwritten. Only those files that were not overwritten we may be able to recover with extundelete Install extundelete.

Therefore stop using the partition that holds accidentally deleted files.

It is recommended the drive is mounted read only to avoid data loss. For our Trash this means that we need to boot to an Ubuntu live session to proceed. We then install exundelete to the live session and mount our HOME partition on /dev/sfXx read only to the live system:

ubuntu@ubuntu: sudo mount /dev/<sdXx> -o ro /mnt 

We get best results in case we remembered the exact name of a file we want to recover because we may not need remnants of all files we ever had deleted.

By default files will be recovered to a directory RECOVERED_FILES in the current path from where we had run it. On a live system this needs to be adapted to another output dir on a partition or drive different to the partition we want to recover files from. This partition will have to be mounted with write access to the live system too, e.g. with Nautilus, or to a mount point different to above.

To recover a known file from Trash we issue extundelete with the following options:

sudo extundelete --restore-file  /mnt/home/<user>/.local/share/Trash/files/<name> --output-dir <path> -- /dev/sdXx

Replace <user> by your user name, <name> by the filename we want to recover, <path> by the path we want to write recovered files to.

We can give extundelete a list of files from a file with the option --restore-files <filename>, a directory with the option --restore-directory or let it recover all it finds --restore-all. For even more options read the manpage.

Takkat
  • 142,284
  • To mount read-only you have to type ro instead of rw. With rw it will be mounted as read-write. extundelete will warn you about this. – thiggy01 May 01 '21 at 13:48