Recovering Data on Linux: Getting Files Back From Deleted Partitions and Unallocated Space

Read this article to find out how to recover data on Linux after deleting partitions from a hard disk, memory card, or USB stick. We will also explore how to recover data from unallocated or non-partitioned disk space.

Recovering Data on Linux: Getting Files Back From Deleted Partitions and Unallocated Space

In the world of Linux, system stability and flexibility are the two big advantages. However, even experienced users may face loss of important data. Accidental removal of partitions, errors when working with disk partitioning utilities, or turning a partition into unallocated space – all of these can cause a loss of valuable information.

Luckily, data does not disappear without trace. If you respond to the challenge and use proper tools, the chances to recover everything – or almost everything – are pretty good. In this article, we will explore how to recover data from deleted partitions on Linux, what to do with unallocated space, and what apps and commands can help you recover your stuff effectively.

Go to view
How to Recover Files After Emptying Linux Trash or Using Shift + Del

How to Recover Files After Emptying Linux Trash or Using Shift + Del

Why data can be lost in Linux after deleting a partition

The most common causes of data loss in Linux after deleting a partition are as follows:

  • Accidental removal of a partition (performed with fdisk, parted, gparted). Users may delete the wrong partition by mistake when modifying the disk structure.
  • Mistakes in selecting disks or partitions. For example, when a user types /dev/sda instead of /dev/sdb.
  • Overwriting a partition with a new file system. For example, when formatting with mkfs, old information about a partition can be destroyed.
  • Mistakes in using partition management utilities. Wrong command applied in gpart, fdisk, gdisk or parted may remove the partition table.
  • Errors when installing the operating system. While installing Linux, users may delete an important partition by mistake or reinstall the operating system over old data.
  • Physical damage or power failures may cause a loss of data related to partition structure.
  • Working with unstable or faulty drives. HDD or SSD issues may cause partition to disappear or become inaccessible.
  • Third-party software or virus activities. Some software products can modify or remove partition structure without the user’s approval or even knowledge.
fdisk: partition removed

For example, let’s consider two cases of data recovery:

  • The first: when partitions are deleted after a disk is formatted with the Disks tool;
  • And the second: when partitions were deleted from the Terminal, with the command fdisk.

How to recover data if a partition is deleted with the Disks tool

We’ve got a USB drive with two partitions where files are stored. Let’s delete them.

Ubuntu: disk partitions

To do it:

  • Go to the Disks tool and select the drive. As we can see, it’s got two partitions: one with the ext4 file system, the other – with fat.

  • Click on the disk menu and choose Format Disk.

    Ubuntu: disk formatting

    WARNING!!! If you choose “Overwrite existing data with zeroes”, data recovery will become almost impossible.

    Ubuntu: overwriting disk data with zeroes
  • Confirm the need to format.

A new unallocated area appears, and al the files existing on this disk are lost. The partitions no longer show up in the File Explorer.

Ubuntu: unallocated disk space

How to recover these files?

  • Run Hetman Partition Recovery.

    The tool recovers data from any devices, regardless of the cause of data loss.
  • Find the required disk on the list and double-click on it.

    Hetman Partition Recovery: unallocated disk space
  • In the window Type of analysis, choose your options in the tab Full analysis. In my case, I will leave the options ext4 and fat checked, since the partitions I have removed used to have such file systems.

    Hetman Partition Recovery: full analysis of the unallocated disk space
  • Click Next and wait for the scan to be completed, and it can take some time.

    Hetman Partition Recovery: unallocated disk space analysis running
  • Ready. The analysis is completed.

    Hetman Partition Recovery: Disk analysis is completed
  • As you can see, the program has found the recently deleted partitions. Open them and search for lost data.

    Hetman Partition Recovery: deleted partitions
  • Select the required files and folders, and click Recovery.

    Hetman Partition Recovery: file recovery
  • In the next window, choose Save to hard disk and give the path where to save the files.

  • Click Recovery. The process can take some time depending on the amount of data you want to get back.

  • Finish.

    Hetman Partition Recovery: files are restored
  • Go to the folder you have chosen for saving data to see that all the selected files are saved there.

    Ubuntu: recovered files

You’ve seen data recovery from unallocated disk space with the example of Ubuntu and such file systems as ext4 and exfаt. However, you can recover data on other versions of Linux, regardless of the file system on the deleted partition and the storage type, in exactly the same way.

How to recover data if a partition is deleted with the Terminal (illustrated by fdisk)

What should we do if a partition is accidentally deleted from the Terminal? For example, with the use of fdisk, parted, or gparted? Is it possible to recover data if the partition table is deleted with the use of gpart, cfdisk, gdisk or parted?

Suppose we have a hard disk divided into several partitions. In my case, they are ext4, xfs, btrfs, and exfat. The file systems in those partitions can be virtually anything that you prefer.

Mint: ext4, xfs, btrfs, and exfat partitions

There are files on the disk.

Mint: xfs partition

Let’s remove some partitions. To do it:

  • Run the Terminal and type the command fdisk.

  • If you can’t access the Disks tool, type this command to see the list of partitions:

    sudo fdisk -l

    Mint: sudo fdisk -l
  • Here is our disk with partitions.

    sudo fdisk -l: partitions on disk sdb
  • To move to our disk, type the following:

    sudo fdisk /dev/sdb

    sudo fdisk /dev/sdb
  • The command fdisk starts on our disk sdb. Press m to see the syntax fdisk.

    Syntax fdisk
Command Description
sudo fdisk -l View the list of all disks and partitions
sudo fdisk /dev/sdX Run fdisk to modify a specific disk (for example, /dev/sda)
m Show reference with commands in fdisk environment
p Display current partition table
n Create a new partition
d Delete an existing partition
t Modify partition type
a Label the partition as boot
w Save changes and exit
q Exit without saving
  • To delete a partition, press d.

  • For example, let’s delete two first partitions. To do it, give the number of the first partition. Then add the number of the other one.

    fdisk: partitions removed
  • To complete performance of the entered commands, type w (that is, confirm performance of the entered commands and shutdown fdisk).

    fdisk: running commands  (w)
  • As you can see, the selected partitions are deleted.

    Mint: deleted partitions on disk sdb

Since I haven’t deleted all disk partitions but only the first two partitions, in the area where they existed we can now see unallocated disk space. And access to the data stored in these partitions is lost.

To recover files and folders from the unallocated disk space of a hard disk, USB stick, or memory card:

  • Install and run Hetman Partition Recovery.

    The tool recovers data from any devices, regardless of the cause of data loss.
  • In the left-side window the program will display all existing local disks as well as physical disks connected to this computer.

    Hetman Partition Recovery: unallocated space on disk sdb
  • In the Disks tool we can see that the required UNALLOCATED SPACE is on disk sdb and has the following size.

    Mint: unallocated space on disk sdb
  • In the app, I can see this unallocated space. Therefore, I will be recovering lost files from there.

    Hetman Partition Recovery: unallocated space on disk sdb
  • To do it, let’s right-click on it, and choose Open.

    Hetman Partition Recovery: disk sdb scan
  • Select Full analysis for the disk, And specify file systems for the partitions where we need to recover data from.

    Hetman Partition Recovery: full analysis for disk sdb
  • Wait until the disk scan is over. This will take some time, depending on the storage capacity.

  • As you can see, Hetman Partition Recovery has found the required partitions.

    Hetman Partition Recovery: deleted partitions on disk sdb
  • Go there. You can see that all lost files and folders are here. You can have a look at their contents in the Preview window. To do it, just click on a file.

    Hetman Partition Recovery: lost folders on disk sdb
  • To recover the required files or folders, select them, and hit the Recovery button. Choose the drive and folder for recovery.

    Hetman Partition Recovery: folder recovery on disk sdb
  • Finish. The files are recovered.

    Mint: recovered folders on disk sdb

You’ve seen data recovery from unallocated disk space with the example of Mint. However, you can recover data on other versions of Linux, regardless of the file system on the deleted partition and the storage type, in exactly the same way.

As you have juts noticed, this utility made it quite quickly and easily, and it took us little effort thanks to the user-friendly interface and the convenient recovery wizard.

Conclusion

Data recovery in Linux after deleting partitions or from unallocated space is a difficult task, but quite possible if you take proper actions at the right time. The main rule is to stop writing new data to disk before the recovery process is completed.

Tools like TestDisk, PhotoRec, GParted or professional software like Hetman Partition Recoveryare capable of recovering missing partitions and restoring access to valuable files.

Knowing the basic principles behind file systems and partition management apps, and understanding the correct sequence of actions allow to reduce risks to a minimum while saving important information. Whatever happens, the best way to avoid data loss is to back it up regularly.

Remember: prevention is always easier than recovery!

Vladimir Artiukh

Author: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Oleg Afonin

Editor: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat