How to recover deleted files on Linux using TestDisk step by step

Why TestDisk saves your information on Linux

When a file is deleted on Linux, the operating system usually just removes the pointer indicating where it was stored, leaving raw data intact until new files overwrite it. TestDisk is an extremely powerful open-source tool designed to scan the disk for these lost structures, rebuilding partition tables and recovering accidentally deleted files. If you have ever experienced the despair of formatting the wrong drive or watching an entire partition disappear, understanding how to operate this tool via the terminal can make the difference between relief and permanent data loss. Much like investigating hardware failures with a POST diagnostic card on faulty motherboards, data rescue requires method and patience.

Preparing the environment and installing the tool

Before starting any recovery procedure, the golden rule is to avoid writing new data to the affected disk to prevent overwriting the blocks where your lost files still reside. To install TestDisk on Debian or Ubuntu-based distributions, open the terminal and run the system's default package manager with administrative privileges. The process is fast and consumes very few system resources, running entirely in text mode to ensure compatibility with corrupted systems that no longer boot the graphical interface.

sudo apt update && sudo apt install testdisk

If you use Fedora or Arch Linux-based distributions, the procedure is equally simple using the corresponding dnf or pacman commands. It is essential that you run the utility using the root user or the sudo command, because deep scanning of disk tracks and sectors requires direct access to the operating system's block devices, something restricted to administrators.

Initiating the lost partition scan

With the utility installed, the next step is to run it by typing the corresponding command in the terminal. The program's initial interface will ask whether you want to create a log file to record actions performed during the scan, which is highly recommended for auditing and technical tracking.

sudo testdisk

On the next screen, TestDisk will display all hard drives and storage units connected to your computer, including flash drives and memory cards. You must use the keyboard arrows to select the disk where the files were stored and press Enter to proceed. Next, the software will ask you to identify the disk's partition table type, such as Intel/PC, EFI GPT, or Mac, with the program usually detecting the correct format automatically based on the signature found in the device's first sectors.

Analyzing the structure and searching for deleted files

After selecting the correct partition table, choose the Analysis option so the utility examines the current disk structure and locates partitions that may have been deleted or corrupted. If the target partition does not appear in the initial listing, you can trigger a quick search or a deep scan, known as Deep Search, which reads the disk sector by sector looking for known file signatures like PDF documents, JPEG images, and archives. To deepen your knowledge on data integrity and damaged media rescue, check out our detailed guide on how to recover partitions with TestDisk in complex scenarios.

When TestDisk finds a valid partition, it displays it highlighted in green or with a tag indicating recovery possibility. You can browse the internal contents of the partition by pressing the 'P' key, which allows you to view the exact list of folders and files present in that sector even before making any permanent changes to the disk. This preview is essential to confirm whether you found the exact spot where your important documents were stored.

Safely copying recovered data

With the desired files located in TestDisk's listing screen, the safest procedure is to copy them directly to a healthy partition or an external storage drive, avoiding writing recovered data to the same unit that experienced the issue. To perform this copy, simply navigate to the desired file or directory and press the 'C' key on your keyboard, then select the destination where the file will be saved in your current file system.

# Example of checking free space on destination before rescue copy: df -h

This surgical approach ensures that if something goes wrong during the main partition table restoration process, your precious documents will already be saved and accessible in a safe location. If you need to deal with data loss scenarios in Windows environments in the future, you can also apply similar strategies as demonstrated in our article on how to recover deleted files on Windows using CMD.

Final considerations on data recovery

Recovering deleted files or corrupted partitions on Linux using TestDisk is an indispensable technical skill for system administrators and tech enthusiasts seeking autonomy when facing unexpected issues. While command-line tools offer impressive power for direct intervention in hardware and logical structures, the best mitigation strategy remains prevention through automated backup routines and constant monitoring of hard drive health.