How to recover deleted files in Linux [Beginner’s Guide]

Accidentally deleted an important file in Linux? Don’t panic—you’re not the first, and you won’t be the last. Whether it was a rm gone wrong or a slip in the GUI, file recovery is possible. This guide will walk you through the basics of how Linux handles deletions and what you can do to bring your files back.

What Happens When You Delete a File in Linux?

Unlike in Windows or macOS, Linux doesn’t have a universal “Recycle Bin” (though desktop environments like GNOME and KDE have trash folders). When you delete something with rm, it’s not just sent to the trash—it’s unlinked from the file system immediately. But here’s the catch: the data usually isn’t gone right away. The space is just marked as available for reuse. That’s your window of opportunity.

First Rule: Stop Using the Disk

The moment you realize you’ve deleted something, stop writing data to that drive. Any new data could overwrite the deleted files and make recovery impossible.

If the deleted file was on your main partition (/), don’t install anything new or create files. If possible, shut down the system and boot from a live USB to prevent further data loss.

Method 1: Check the Trash (GUI Users)

If you deleted the file using a file manager (like Nautilus or Dolphin), check your Trash.

Open your file manager.
Look for the Trash or Deleted Items.
Right-click the file and choose Restore.

If it’s not there, move on to more advanced methods.

Method 2: TestDisk (For Ext4, FAT, NTFS)

TestDisk is a powerful open-source tool that can recover lost partitions and undelete files. Here’s how to use it:

Step 1: Install TestDisk

On Debian/Ubuntu:

sudo apt install testdisk

On Fedora:

sudo dnf install testdisk

Step 2: Run TestDisk

sudo testdisk

Use arrow keys and follow these steps:

Select Create to create a new log file.
Choose the disk where your file was stored.
Select the correct partition type (usually Intel or EFI GPT).
Choose Advanced, then select the partition.
Choose Undelete.
Navigate through the files, press c to copy the deleted file, and choose a recovery destination.

Method 3: extundelete (Only for ext3/ext4 File Systems)

This only works if the partition is unmounted (or can be unmounted).

Step 1: Install extundelete

sudo apt install extundelete

Step 2: Unmount the Partition

Let’s say your partition is /dev/sda1:

sudo umount /dev/sda1

Step 3: Recover Files

To recover all deleted files:

sudo extundelete /dev/sda1 --restore-all

Recovered files will be saved in a folder called RECOVERED_FILES.

⚠️ Important: extundelete won’t work on SSDs with TRIM enabled (which wipes deleted blocks quickly).

Method 4: PhotoRec (Also Works on Raw Files)

PhotoRec (comes bundled with TestDisk) isn’t just for photos—it can recover a wide range of file types, even from damaged partitions.

sudo photorec

Choose the disk.
Select the file system.
Choose where to save recovered files.
Sit back and let it scan.

It doesn’t preserve file names or paths, but it’s effective.

Bonus Tip: Prevent Future File Loss

You can’t undo rm easily, but you can reduce the chances of accidental deletion:

Alias rm to trash or use safe-rm. alias rm='trash'
Use a backup system. Options include:
- rsync
- Timeshift
- Deja Dup
For command-line deletion with undo, try installing trash-cli.

Final Thoughts

Recovering deleted files on Linux can feel like a black box, but with the right tools and quick action, you’ve got a fighting chance. The key is to stop using the drive, act fast, and always back up regularly.

Got a success story or a better tool? Drop it in the comments—we’re all learning here.