Tuesday, February 24, 2009

Undelete A File From A Fat File System Under Linux

Hard drives store deleted information until it is overwritten.


When you delete a file from your computer, what you actually do is tell the computer that it is OK to use the space from that file to record new information. If you accidentally delete a file, until it gets overwritten you can recover it with the proper software tools. These tools are available in the Linux repositories: TestDisk and PhotoRec allow you to retrieve deleted FAT-formatted files.


Instructions


1. Open your Linux package manager and run a search for PhotoRec. Select it and install it.


2. Open a terminal and execute the following command:


sudo photorec


3. Use the arrow keys to choose the drive where your file was stored and press "Enter" to continue.


4. Select the Intel/PC partition option. PhotoRec automatically detects the type of partition, but for a FAT file format, the option you need is always Intel/PC. Use the arrow keys to move through the list and press "Enter."


5. Navigate to the partition where you had stored the deleted file and press "Enter." The description of the partition should be either FAT16 or FAT32. Select the "Search" option from the bottom of the screen.


6. Select "Other" from the list of formats. The only options are "ext2/ext3" and "Other." FAT formats fall under the "Other" category. Press the "Enter" key.


7. Highlight the "Free" option so PhotoRec only recovers the deleted files, rather than the entire partition. The "Whole" option works better if the drive may be corrupted. Push the "Enter" key.


8. Navigate to the directory or folder where the deleted file was and push "Enter" again. Allow PhotoRec to recover the deleted files to that directory.







Tags: arrow keys, delete file, deleted file, deleted files, Enter Navigate