Is it possible to find files that have been deleted and the trash is empty?
My desktop was cleaned out and I am not sure why, but it had some files I would like to recover.
Is it possible to find files that have been deleted and the trash is empty?
My desktop was cleaned out and I am not sure why, but it had some files I would like to recover.
Maybe...
I suggest you give extundelete a try. (Assuming that you use an ext partition)
extundelete is a utility that can recover deleted files from an ext3 or ext4 partition. The ext3 file system is the most common file system when using Linux, and ext4 is its successor. extundelete uses the information stored in the partition's journal to attempt to recover a file that has been deleted from the partition. There is no guarantee that any particular file will be able to be undeleted, so always try to have a good backup system in place, or at least put one in place after recovering your files!
As the site warns, the more writes to the filesystem, the less likely you'll get any files. You probably want to unmount your partition immediately and then run the program.
Files that had been emptied from Trash may have been overwritten. Only those files that were not overwritten we may be able to recover with extundelete .
Therefore stop using the partition that holds accidentally deleted files.
It is recommended the drive is mounted read only to avoid data loss. For our Trash this means that we need to boot to an Ubuntu live session to proceed. We then install exundelete
to the live session and mount our HOME partition on /dev/sfXx
read only to the live system:
ubuntu@ubuntu: sudo mount /dev/<sdXx> -o ro /mnt
We get best results in case we remembered the exact name of a file we want to recover because we may not need remnants of all files we ever had deleted.
By default files will be recovered to a directory RECOVERED_FILES
in the current path from where we had run it. On a live system this needs to be adapted to another output dir on a partition or drive different to the partition we want to recover files from. This partition will have to be mounted with write access to the live system too, e.g. with Nautilus, or to a mount point different to above.
To recover a known file from Trash we issue extundelete with the following options:
sudo extundelete --restore-file /mnt/home/<user>/.local/share/Trash/files/<name> --output-dir <path> -- /dev/sdXx
Replace <user>
by your user name, <name>
by the filename we want to recover, <path>
by the path we want to write recovered files to.
We can give extundelete a list of files from a file with the option --restore-files <filename>
, a directory with the option --restore-directory
or let it recover all it finds --restore-all
. For even more options read the manpage.