How to recover files and corrupted partitions on Linux via CLI

The real impact of a corrupted partition on Linux

Losing access to a partition or discovering that important files have suddenly disappeared is one of the worst nightmares for anyone managing servers or workstations. In practice, this means the logical structure used by the operating system to organize data has been damaged, often due to power surges or hardware glitches. Before attempting any risky repairs, it is essential to understand what happens behind the scenes to prevent permanent data loss on ext4 and XFS systems.

When the operating system fails to read the partition table, it treats the storage as empty or unallocated space. However, the raw data remains written magnetically or on flash memory chips. Before diving into forensic tools, remember that hardware integrity is the first step, much like what we learn when testing power drops with UPS and bench load units to prevent recurring damage from electrical instability. From there, we can deploy command-line utilities to inspect and rescue what was lost.

Protecting your data before running any commands

The most common mistake when attempting to recover corrupted data is writing new information to the same storage drive. Any command executed on the affected disk can overwrite the exact blocks where your old files still reside. Therefore, the golden rule of forensic recovery is never to work directly on the original media if there is space for cloning, or at least to exercise extreme caution using read-only modes.

If you suspect that electrical issues or hardware failures caused the corruption and want to audit system behavior under stress, it is worth checking how to inspect corrupted network traffic with eBPF to identify packet loss or systemic instabilities. For local storage, creating a safety image via the command line ensures you have an exact copy to manipulate without additional risks.

Identifying the damage with native Linux commands

Before resorting to specialized recovery software, we need to diagnose the extent of the problem using standard Linux terminal tools. The lsblk command lists all block devices connected to the system, showing how the kernel currently sees hard drives and partitions. Next, the parted or fdisk utility allows you to examine the partition table to check if the boot sector or primary metadata was erased.

If the file system is ext4, the fsck utility automatically attempts to repair inconsistencies using the backup superblock. However, on XFS partitions, the metadata structure operates differently, and the xfs_repair command must be used with extreme caution, as it discards unrecoverable corrupted blocks to save the rest of the directory structure.

How to use TestDisk to scan and recover partitions

When native commands fail to mount the partition, TestDisk becomes the ultimate command-line tool for deep scans. It analyzes disk cylinders looking for signatures of lost file systems, managing to rebuild entire partition tables that had vanished. To start the process, we run the binary with administrative privileges directly in the terminal.

sudo testdisk

Upon opening TestDisk's text-based interface, the user must select the affected disk, choose the partition table type (usually Intel/PC partition for traditional systems or EFI GPT for modern machines), and proceed to the advanced analysis option. The program will run a quick scan and, if necessary, a deeper search to locate traces of the corrupted partition.

Rescuing deleted files in ext4 and XFS

Beyond recovering entire partitions, TestDisk and its sibling PhotoRec allow you to extract individual deleted files based on header signatures, even when the file system is severely damaged. This means that even if the directory table is completely unreadable, you can recover documents, images, and source code directly to a safe folder on another disk.

After locating the desired files in the TestDisk interface, press the copy key (C) and select a destination located on a completely healthy partition. Never save recovered files on the drive that suffered corruption, as the risk of overwriting valid data is extremely high during the writing process.

Validating the integrity of recovered data

The job doesn't end when files appear in the new directory. Since forensic recovery deals with damaged sectors, some files might be internally corrupted, containing only binary garbage or zeroed-out blocks. It is essential to perform an integrity check using cryptographic hashes or automated tools to ensure the rescued documents and code are fully functional.

To keep your infrastructure organized and secure against future incidents, you can also automate packaging and protection routines by learning how to create encrypted tar.gz files in the terminal, ensuring your backups remain confidential and intact in any contingency scenario.

Final thoughts

Recovering corrupted partitions and deleted files via the command line requires patience, method, and rigorous adherence to safety procedures. Tools like TestDisk turn the terminal into a powerful rescue station capable of reversing complex logical disasters in ext4 and XFS environments. Maintaining a routine of backup testing and continuous monitoring is the only way to mitigate the impact of these failures in daily operations.