Recovering Data on Linux: Getting Files Back From Deleted Partitions and Unallocated Space
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
Read this article to find out how to recover data on Linux after deleting partitions from a hard disk, memory card, or USB stick. We will also explore how to recover data from unallocated or non-partitioned disk space.
- Why data can be lost in Linux after deleting a partition
- How to recover data if a partition is deleted with the Disks tool
- How to recover data if a partition is deleted with the Terminal (illustrated by fdisk)
- Conclusion
- Questions and answers
- Comments
In the world of Linux, system stability and flexibility are the two big advantages. However, even experienced users may face loss of important data. Accidental removal of partitions, errors when working with disk partitioning utilities, or turning a partition into unallocated space – all of these can cause a loss of valuable information.
Luckily, data does not disappear without trace. If you respond to the challenge and use proper tools, the chances to recover everything – or almost everything – are pretty good. In this article, we will explore how to recover data from deleted partitions on Linux, what to do with unallocated space, and what apps and commands can help you recover your stuff effectively.
How to Recover Files After Emptying Linux Trash or Using Shift + Del
Why data can be lost in Linux after deleting a partition
The most common causes of data loss in Linux after deleting a partition are as follows:
- Accidental removal of a partition (performed with fdisk, parted, gparted). Users may delete the wrong partition by mistake when modifying the disk structure.
- Mistakes in selecting disks or partitions. For example, when a user types /dev/sda instead of /dev/sdb.
- Overwriting a partition with a new file system. For example, when formatting with mkfs, old information about a partition can be destroyed.
- Mistakes in using partition management utilities. Wrong command applied in gpart, fdisk, gdisk or parted may remove the partition table.
- Errors when installing the operating system. While installing Linux, users may delete an important partition by mistake or reinstall the operating system over old data.
- Physical damage or power failures may cause a loss of data related to partition structure.
- Working with unstable or faulty drives. HDD or SSD issues may cause partition to disappear or become inaccessible.
- Third-party software or virus activities. Some software products can modify or remove partition structure without the user’s approval or even knowledge.
For example, let’s consider two cases of data recovery:
- The first: when partitions are deleted after a disk is formatted with the Disks tool;
- And the second: when partitions were deleted from the Terminal, with the command fdisk.
How to recover data if a partition is deleted with the Disks tool
We’ve got a USB drive with two partitions where files are stored. Let’s delete them.
To do it:
-
Go to the Disks tool and select the drive. As we can see, it’s got two partitions: one with the ext4 file system, the other – with fat.
-
Click on the disk menu and choose Format Disk.
WARNING!!! If you choose “Overwrite existing data with zeroes”, data recovery will become almost impossible.
-
Confirm the need to format.
A new unallocated area appears, and al the files existing on this disk are lost. The partitions no longer show up in the File Explorer.
How to recover these files?
-
Run Hetman Partition Recovery.
The tool recovers data from any devices, regardless of the cause of data loss. -
Find the required disk on the list and double-click on it.
-
In the window Type of analysis, choose your options in the tab Full analysis. In my case, I will leave the options ext4 and fat checked, since the partitions I have removed used to have such file systems.
-
Click Next and wait for the scan to be completed, and it can take some time.
-
Ready. The analysis is completed.
-
As you can see, the program has found the recently deleted partitions. Open them and search for lost data.
-
Select the required files and folders, and click Recovery.
-
In the next window, choose Save to hard disk and give the path where to save the files.
-
Click Recovery. The process can take some time depending on the amount of data you want to get back.
-
Finish.
-
Go to the folder you have chosen for saving data to see that all the selected files are saved there.
You’ve seen data recovery from unallocated disk space with the example of Ubuntu and such file systems as ext4 and exfаt. However, you can recover data on other versions of Linux, regardless of the file system on the deleted partition and the storage type, in exactly the same way.
How to recover data if a partition is deleted with the Terminal (illustrated by fdisk)
What should we do if a partition is accidentally deleted from the Terminal? For example, with the use of fdisk, parted, or gparted? Is it possible to recover data if the partition table is deleted with the use of gpart, cfdisk, gdisk or parted?
Suppose we have a hard disk divided into several partitions. In my case, they are ext4, xfs, btrfs, and exfat. The file systems in those partitions can be virtually anything that you prefer.
There are files on the disk.
Let’s remove some partitions. To do it:
Run the Terminal and type the command fdisk.
-
If you can’t access the Disks tool, type this command to see the list of partitions:
sudo fdisk -l
-
Here is our disk with partitions.
-
To move to our disk, type the following:
sudo fdisk /dev/sdb
-
The command fdisk starts on our disk sdb. Press m to see the syntax fdisk.
| Command | Description |
|---|---|
| sudo fdisk -l | View the list of all disks and partitions |
| sudo fdisk /dev/sdX | Run fdisk to modify a specific disk (for example, /dev/sda) |
| m | Show reference with commands in fdisk environment |
| p | Display current partition table |
| n | Create a new partition |
| d | Delete an existing partition |
| t | Modify partition type |
| a | Label the partition as boot |
| w | Save changes and exit |
| q | Exit without saving |
-
To delete a partition, press d.
-
For example, let’s delete two first partitions. To do it, give the number of the first partition. Then add the number of the other one.
-
To complete performance of the entered commands, type w (that is, confirm performance of the entered commands and shutdown fdisk).
-
As you can see, the selected partitions are deleted.
Since I haven’t deleted all disk partitions but only the first two partitions, in the area where they existed we can now see unallocated disk space. And access to the data stored in these partitions is lost.
To recover files and folders from the unallocated disk space of a hard disk, USB stick, or memory card:
-
Install and run Hetman Partition Recovery.
The tool recovers data from any devices, regardless of the cause of data loss. -
In the left-side window the program will display all existing local disks as well as physical disks connected to this computer.
-
In the Disks tool we can see that the required UNALLOCATED SPACE is on disk sdb and has the following size.
-
In the app, I can see this unallocated space. Therefore, I will be recovering lost files from there.
-
To do it, let’s right-click on it, and choose Open.
-
Select Full analysis for the disk, And specify file systems for the partitions where we need to recover data from.
-
Wait until the disk scan is over. This will take some time, depending on the storage capacity.
-
As you can see, Hetman Partition Recovery has found the required partitions.
-
Go there. You can see that all lost files and folders are here. You can have a look at their contents in the Preview window. To do it, just click on a file.
-
To recover the required files or folders, select them, and hit the Recovery button. Choose the drive and folder for recovery.
-
Finish. The files are recovered.
You’ve seen data recovery from unallocated disk space with the example of Mint. However, you can recover data on other versions of Linux, regardless of the file system on the deleted partition and the storage type, in exactly the same way.
As you have juts noticed, this utility made it quite quickly and easily, and it took us little effort thanks to the user-friendly interface and the convenient recovery wizard.
Conclusion
Data recovery in Linux after deleting partitions or from unallocated space is a difficult task, but quite possible if you take proper actions at the right time. The main rule is to stop writing new data to disk before the recovery process is completed.
Tools like TestDisk, PhotoRec, GParted or professional software like Hetman Partition Recoveryare capable of recovering missing partitions and restoring access to valuable files.
Knowing the basic principles behind file systems and partition management apps, and understanding the correct sequence of actions allow to reduce risks to a minimum while saving important information. Whatever happens, the best way to avoid data loss is to back it up regularly.
Remember: prevention is always easier than recovery!
