Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to use Testdisk to restore deleted files", the content of the article is simple and clear, easy to learn and understand, the following please follow the editor's ideas slowly in depth, together to study and learn "how to use Testdisk to restore deleted files" bar!

Testdisk is a powerful free cross-platform data recovery tool. According to a brief introduction on its website, this software is mainly designed to recover lost partitions and fix problems in which the system cannot boot due to human or virus-induced partition table errors.

Install testdisk

You can install testdisk using commands such as apt install testdisk or yum install testdisk. Interestingly, it is not only a Linux tool, but also suitable for MacOS, Solaris, and Windows.

Documentation can be found in cgsecurity.org.

Restore Fil

First of all, you must log in as root or have sudo permission to use testdisk. If you do not have sudo access, you will be kicked out at the beginning of the process, and if you choose to create a log file, you will eventually get a message like this:

TestDisk exited normally.jdoe is not in the sudoers file. This incident will be reported.

When you use testdisk to recover deleted files, you will eventually put the recovered files in the directory where you started the tool, and these files will belong to root. For this reason, I like to start in a directory like / home/recovery. Once the files have been successfully restored and validated, they can be moved back to where they belong and their ownership can be restored.

Start under the selected directory that you can write to:

$cd / home/recovery$ testdisk

The first page of information provided by testdisk describes the tool and shows some options. At least in the beginning, it's a good idea to create a log file, as the information it provides may prove useful. Here's how to do it:

Use arrow keys to select, then press Enter key: > [Create] Create a new log file [Append] Append information to log file [No Log] Don't record anything

The > on the left and the inverted font and background color you see indicate the options you will use when you press enter. In this example, we chose to create a log file.

You will then be prompted for your password (unless you have recently used sudo).

The next step is to select the disk partition where the deleted file is stored (if it is not highlighted). Use the up and down arrows to move to it as needed. Then click the right arrow twice and press enter when "Proceed" is highlighted.

Select a media (use Arrow keys Then press Enter): Disk / dev/sda-120GB / 111GiB-SSD2SC120G1CS1754D117-551 > Disk / dev/sdb-500GB / 465GiB-SAMSUNG HE502HJDisk / dev/loop0-13 MB / 13 MiB (RO) Disk / dev/loop1-101MB / 96 MiB (RO) Disk / dev/loop10-148MB / 141MiB (RO) Disk / dev/loop11-36 MB / 35 MiB (RO) Disk / dev/loop12-52 MB / 49 MiB (RO) Disk / Disk-78 dev/loop13 / 75 dev/loop13 (MB) dev/loop13 / MB Loop14-173MB / 165MiB (RO) Disk / dev/loop15-169MB / 161MiB (RO) > [Previous] [Next] [Proceed] [Quit]

In this example, the deleted file is in the home directory of / dev/sdb.

At this point, testdisk should have selected the appropriate partition type.

Disk / dev/sdb-500 GB / 465 GiB-SAMSUNG HE502HJPlease select the partition table type, press Enter when done. [Intel] Intel/PC partition > [EFI GPT] EFI GPT partition map (Mac i386, some x86 * 64...) [Humax] Humax partition table [Mac] Apple partition map (legacy) [None] Non partitioned media [Sun] Sun Solaris partition [XBox] XBox partition [Return] Return to disk selection

In the next step, press the down arrow to point to [Advanced] Filesystem Utils.

[Analyse] Analyse current partition structure and search for lost partitions > [Advanced] Filesystem Utils [Geometry] Change disk geometry [Options] Modify options [Quit] Return to disk selection

Next, look at the selected partition.

Partition Start End Size in sectors > 1 P Linux filesys. Data 2048 910155775 910153728 [drive2]

Then press the right arrow to select "[List]" at the bottom, and press enter.

[Type] [Superblock] > [List] [Image Creation] [Quit]

Notice that it looks like we started with the root directory /, but in fact this is the base point of the file system we are working on. In this case, it is / home.

Directory / drwxr-xr-x 00 4096 23-Sep-2020 17:46 .drwxr-xr-x 00 4096 23-Sep-2020 17:46.. drwx--- 00 16384 22-Sep-2020 11:30 lost+founddrwxr-xr-x 1008 1008 4096 9-Jul-2019 14:10 dorothydrwxr-xr-x 1001 1001 4096 22-Sep-2020 12:12 nemodrwxr-xr-x 10054096 19-Jan -2020 11:49 eeldrwxrwxrwx 0 4096 25-Sep-2020 08:08 recovery...

Next, we press the arrow to point to the specific home directory.

Drwxr-xr-x 1016 1016 4096 17-Feb-2020 16:40 gino > drwxr-xr-x 1000 1000 20480 25-Sep-2020 08:00 shs

Press enter to move to the directory, and then move down arrow to subdirectory as needed. Note that if you choose wrong, you can choose the one near the top of the list.. Return.

If you can't find the file, you can press / (just like when you start the search in vi) to prompt you for a file name or part of it.

Directory / shs-rw-rw-r- 1000 1000 24667 8-Feb-2019 08:57 Up_on_the_Roof.pdf

Once you find the file that needs to be recovered, press c to select it.

Note: you will see useful instructions at the bottom of the screen:

Use Left arrow to go back, Right to change directory, h to hide deleted files q to quit,: to select the current file, a to select all files C to copy the selected files, cto copy the current file

At this point, you can choose the location in the starting directory to restore the file (see the previous instructions, check in an appropriate place before moving the file back to the origin). In this case, the / home/recovery directory has no subdirectories, so this is our recovery point.

Note: you will see useful instructions at the bottom of the screen:

Please select a destination where / shs/Up_on_the_Roof.pdf will be copied.Keys: Arrow keys to select another directory C when the destination is correct Q to quitDirectory / home/recovery

Once you see the green words "Copy done! 1 ok, 0 failed", you will know that the file has been restored.

In this case, the file is left under / home/recovery/shs (starting directory, appending the selected directory).

You may want to verify that the restored file looks correct before moving the file back to its original location. Make sure you also restore the original owner and group, because the file is owned by root at this time.

Note: for many steps in the file recovery process, you can use exit (press Q or "[Quit]") to return to the previous step. If you prefer, you can choose the exit option to go back to the first step in the process, or you can choose to press ^ c to exit immediately.

Thank you for your reading, the above is the content of "how to use Testdisk to recover deleted files". After the study of this article, I believe you have a deeper understanding of how to use Testdisk to restore deleted files, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.