Recover Deleted Files in Elementary OS with TestDisk and PhotoRec

Data loss happens more often than most people expect, especially during a Sydney summer when a heatwave can push an ageing external drive past its thermal limits. A power surge during a Canberra thunderstorm, an accidental rm -rf command in the terminal, or a failed upgrade can all empty out folders in seconds. The good news for elementary OS users is that the ext4 filesystem only marks space as available rather than overwriting the bytes immediately, so undelete operations remain feasible long after the original error.

The two open-source utilities most often recommended by Linux sysadmins and home users alike are TestDisk and PhotoRec. They share a lineage, both come from the same developer, Christophe Grenier, and they handle complementary tasks. TestDisk focuses on partitions and whole filesystems, restoring the structural information that lets a disk mount again. PhotoRec works on the raw data underneath, carving individual files out of a block device by recognising headers and signatures. Together they form the backbone of free data recovery on Linux.

Australians running elementary OS tend to discover these tools through the community forums on elementarynow, through word of mouth at local Linux User Group meets in Brisbane or Perth, or after Googling phrases like "ext4 recovery Linux" while sitting on the lounge with a cold drink, hoping the SSD on the desk still has a chance. The tools themselves are small, free of charge, and available from the standard repositories, which fits the practical, no-fuss approach that the Aussie open-source community tends to prefer.

This guide walks through the practical steps to bring back deleted files in elementary OS, from building a bootable Live USB on a thumb drive bought from Officeworks, through installing the tools, to running actual recoveries and avoiding the same disaster next time. It is written for both newcomers who have never opened the terminal and seasoned users who already know their way around sudo.

Meet TestDisk and PhotoRec

TestDisk is the older and broader of the two. It was first released when floppy drives were still common and has been maintained continuously for decades. Its interface is a curses-based menu system that runs entirely inside a terminal, with no graphical wrapper needed. The tool analyses the partition table of a disk, scans for lost or damaged partitions, repairs boot sectors, and reconstructs filesystems such as ext2, ext3, ext4, FAT, NTFS, and others. When a partition has been accidentally deleted, or when the partition table has been overwritten, TestDisk can often rebuild the original layout from the on-disk signatures it finds.

PhotoRec handles the second half of the recovery puzzle. Where TestDisk restores structure, PhotoRec extracts content. It ignores the filesystem metadata and digs through the raw sectors, looking for known file headers for hundreds of formats: JPEG, PNG, MP3, MP4, PDF, DOCX, ODT, and many more. This signature-based approach is what makes PhotoRec effective even when the filesystem itself is corrupted beyond repair, a common scenario after an unexpected shutdown in a regional town where the local substation had a rough afternoon.

Both tools are licensed under the GPL, ship in the elementary OS repositories as part of the testdisk package, and can be run from a Live environment or from the installed system itself. Their stability is well established, and the developers continue to add support for new formats and filesystems as the storage landscape evolves. For Australian users on slower NBN connections in rural Queensland or Tasmania's west, the small download size is a quiet blessing, because the package itself is only a few megabytes.

Build a Live USB and Stop Writing to the Disk

The cardinal rule of any data recovery exercise is to avoid writing new data to the disk that holds the lost files. Every byte that the operating system writes on top of the affected area is a byte that cannot be recovered. The cleanest way to honour this rule is to boot elementary OS from a USB stick and run the tools against the internal SSD or hard drive, which is mounted read-only or not mounted at all.

Creating the Live USB is straightforward. Download the official elementary OS ISO from the project's website, then flash it to a USB stick using a tool such as Etcher, GNOME Disks, or the built-in image writer if using a different distro to prepare it. A 16 GB drive picked up from Officeworks for around twelve Australian dollars is plenty, and the same stick can be reused later as a rescue drive. On modern hardware, the USB 3.0 ports on most laptops deliver the write over a second-to-second operation, so the entire process takes only a few minutes.

Once the Live USB is ready, reboot the machine, enter the boot menu, and select the USB stick. Inside the Live session, open the file manager or the Disks application to confirm that the internal drive containing the lost files is visible but not mounted. If the system mounts it automatically, unmount it before continuing. From here on, all recovery work targets the unmounted block device such as /dev/sda or /dev/nvme0n1, never a path inside /media or /home.

Australians working on a hot summer arvo will notice that a warm laptop runs louder, which is a reminder that heat and spinning disks are not friends. If the affected drive is an external HDD sitting on a desk in a non-air-conditioned home office, give it a few minutes to cool down before plugging it in. Cooler electronics are less likely to develop new faults mid-recovery, and a stable drive gives the scanning routines fewer reasons to misbehave.

Install TestDisk and PhotoRec

When running from the installed elementary OS system rather than the Live USB, the tools can be added through the standard package manager. Open a terminal, either through the Applications menu or by pressing the Super key and typing a quick command, and run sudo apt update followed by sudo apt install testdisk. The package contains both binaries, so a single command installs the pair.

If you are working from the Live USB environment and need the tools there, the elementary OS live ISO already includes a number of utilities, but testdisk is not always present. In that case, an apt install still works provided the Live session has network access, which it usually does over Wi-Fi once you authenticate through the captive portal common at hotels and cafes around the country.

After installation, confirm that both binaries are available by typing testdisk --version and photorec --version in their respective forms. The output includes the version number and a brief copyright line, which is a quick sanity check before continuing. From this point onwards, both commands are available globally and can be launched with sudo photorec or sudo testdisk against the appropriate block device.

Walk Through TestDisk for Partition Recovery

When the symptom is a missing partition, an unreadable disk, or a filesystem that refuses to mount, TestDisk is the right starting tool. Launch it with sudo testdisk /dev/sda, substituting the actual device identifier for the affected drive. The first screen asks whether to create a new log file, which is usually the default option, because the log helps if the scan needs to be resumed later.

Next, select the disk geometry. For most modern disks, TestDisk auto-detects the correct sector settings, so accepting the defaults is fine. From the main menu, choose Analyse, then Quick Search. TestDisk will scan the disk for existing partitions and show what it finds in a list. If the deleted partition appears, it can be highlighted and recovered with a single keystroke.

If the Quick Search does not surface the lost partition, run a deeper scan with Deeper Search. This pass takes considerably longer, sometimes several hours on a multi-terabyte HDD, so it is a good task to schedule for an evening when the laptop can be left running on the kitchen table. Once the scan locates the partition, confirm the write operation, and TestDisk will restore the partition table entry.

After TestDisk finishes, reboot the system and check whether the affected partition mounts automatically. If it does, the data is accessible again, and the recovery is essentially complete. If the filesystem itself shows errors, run sudo e2fsck -f -n /dev/sdaX on the recovered ext4 partition to check it without modifying anything. The -n flag tells e2fsck to operate in read-only mode, which is the safe option for a freshly recovered volume.

Walk Through PhotoRec for Individual Files

When the partition and its layout are intact but individual files have gone missing, PhotoRec is the right tool. Launch it with sudo photorec /dev/sdb1 to recover from a specific partition, or with sudo photorec /dev/sda to scan an entire disk. The interface mirrors TestDisk's, starting with a partition selection, then a filesystem family selection, then a destination directory for the recovered files.

The destination is a critical choice. Always recover to a different physical drive than the one being scanned, otherwise the recovery writes over the very sectors it is trying to carve. A second USB drive, a NAS on the local network, or a separate internal SSD all work well. For Australian users, this is the moment to dig out that old 1 TB external HDD that lives in the cupboard and only comes out for backups, because it offers enough space for the often-very-large output.

PhotoRec will then ask for the file types to look for. The default scans for everything, which is comprehensive but slow. Narrowing the selection to specific formats, such as just images and documents, cuts the runtime substantially. The scan then proceeds, showing progress by number of files and by estimated time remaining. Letting the scan run to completion is the safest option, even when the estimated time looks daunting.

When the scan finishes, PhotoRec creates a series of numbered directories in the destination, each holding several hundred recovered files with their original extensions but generic names like f0000123.jpg. The next step is to triage the results using a file manager such as Files (the elementary OS default) or the command-line tool find to locate files by size, by date, or by extension. Sorting through a large recovery is part of the deal, but PhotoRec's reliability is such that the bulk of important files usually re-emerge intact.

Comparing TestDisk and PhotoRec

Stay Safe After the Files Return

Once the lost files are back on a healthy drive, the priority shifts to making sure the next accident is less painful. A regular backup routine using a tool such as Déjà Dup, BorgBackup, or rsync to a second drive is the single most effective protection. The 3-2-1 rule, three copies on two different media with one offsite, has been promoted by the Australian Cyber Security Centre and is as relevant for home users as it is for businesses.

External drives benefit from a cool, stable environment. Storing a spinning HDD on top of a router in a hot Queenslander-style house in summer is asking for trouble, because the combined heat from the device and the ambient air can push temperatures past the operating range. Keeping the backup drive in a drawer or a cupboard when not in use extends its life considerably, which in turn keeps the contents safe.

Finally, take a moment to update the system, enable automatic firmware updates for any USB drives that support them, and consider adding a small uninterruptible power supply between the wall and the desktop. A UPS for around two hundred Australian dollars buys protection against the kind of brownouts that knock out rural transformers during a summer storm, and the investment is small relative to the value of the data it preserves. Start there, and the next time a file vanishes, the recovery is a quick affair rather than a weekend project.