How to recover deleted files on Linux with TestDisk

What is TestDisk and how it saves your data

Losing important files on Linux due to a misconfigured command or an accidental format is a common nightmare. When this happens, the operating system usually just removes the pointers that show where the data was recorded, leaving the physical content intact until new files are saved over it. This is precisely where TestDisk steps in as a lifesaver, operating at a low level to track and rebuild those lost structures.

Unlike complex commercial software, TestDisk is an open-source utility focused exclusively on recovering corrupted partitions and damaged file tables. It doesn't require a heavy graphical interface, running straight from the text terminal with fast, straight-to-the-point commands. If you have faced similar troubles, it is also worth checking our practical guide on how to recover a corrupted Linux partition with TestDisk to expand your rescue maneuver toolkit.

Preparing the environment and installing the tool

Before digging into the guts of your hard drive, the golden rule is to avoid any additional writes to the affected drive. This means you should not install programs on the same disk, download large files, or update the system, because every megabyte written can permanently destroy a file that was still waiting to be restored. Ideally, boot Linux from a live USB or connect the affected disk as a secondary drive in another machine.

With a secure environment set up, installing the utility is extremely simple across major market distributions. On Debian or Ubuntu-based systems, open the terminal and type the standard installation command to pull packages directly from the official repositories. If you need to deal with complex partition tables, complementing this knowledge with detailed techniques in how to repair corrupted GPT partition tables with gdisk ensures an even more solid technical foundation to save your hardware.

Starting the scan and identifying the raw partition

To get your hands dirty, open the terminal and call the tool with administrative privileges, since direct disk access requires superuser permissions. Type the command below and press enter to start the program's text-based interactive interface:

sudo testdisk

Upon opening, the program will ask if you want to create a log file to record operations. Choose the option to create the log, which makes auditing easier if something doesn't go as planned. On the next screen, TestDisk will list all hard drives and storage media connected to your machine. Use the keyboard arrow keys to select the disk containing the lost data and press enter to proceed with the analysis.

Selecting the table type and running the search

Right after choosing the hard drive, the tool will prompt you to identify the partition table type used on the drive. On the vast majority of modern computers, the adopted standard is EFI GPT, while older machines use the Intel MBR format. If you have doubts, TestDisk itself has an automatic detection mechanism that usually gets the correct model right on the first try, making life easier for those who don't remember the hardware's factory details.

With the table defined, select the analysis option so the utility examines the current disk structure and locates lost partitions or those marked as raw, which is the term used when the operating system has lost the ability to read the unit format. The quick search process scans the initial sectors and is usually quite fast, spotting partitions that vanished suddenly after a power outage or abrupt device removal.

Restoring files and saving to a secure location

If the quick scan doesn't find what you are looking for, TestDisk offers a deep search option. This function examines every sector of the disk looking for known file signatures, which takes longer but is extremely efficient for recovering data from partitions that were completely deleted or reformatted. When lost files or directories appear on the screen in green, you can browse through them using the keyboard arrow keys.

To copy the recovered files to a safe location, use the shortcut key indicated in the interface to start the copy. Remember never to save the restored data on the same partition from which they were deleted, as this will cause immediate overwriting of the memory blocks. Connect an external HDD or a spacious USB drive and direct the recovery destination there, ensuring your rescue is completed with zero additional losses and total integrity. To explore these architectural concepts further in production, see our related technical analysis on How to test an ATX power supply without a motherboard using a paperclip.

Final Considerations

Data recovery through TestDisk demonstrates the power that a well-designed command-line tool holds in the hands of a system administrator or enthusiast user. Although the process requires patience and rigorous attention to the executed steps, understanding how low-level file system structures work turns an absolute panic situation into a controllable technical procedure.

Preventive practices, such as maintaining consistent backup routines and testing hardware periodically, remain the best line of defense against catastrophic storage failures. However, knowing how to handle rescue utilities ensures that when the unexpected knocks on your door, you will have the necessary resources to recover your files without relying on expensive or slow third-party services.