Recover Your Deleted Files In Linux using Scalpel Utility

Dec 262011

Original article by Ankur Aggarwal published on http://flossstuff.wordpress.com/

Have you accidentally deleted an important file because you are in a habit of using “Shift+Del” rather than delete only?? Well don’t panic. There is a utility named as “scalpel” which helps you in recovering the so called “permanent deleted” files. Actually when you delete a file permanently (Accidentally or By Intention) , It doesn’t get removed from your hard disk. It get stored in certain blocks of the storage device and they continue to exist in the blocks unless you overwrite them with another files. This article will talk about utilities that will help you in the file recovery. It is always recommended that you shouldn’t recover a file from the device when it is mounted. You should always do the recovery process with the Live CD followed by the file searching in the device like in my case device is /dev/sda1 . If you are unable to understand the upper condition, just forget about it. I am not going to bore you with the theory part anymore. Let’s take a look at the utility.

Scalpel is a file system independent recovery tool. It ‘s basically available for the Linux and Mac OS but you can also run it on windows by compiling it using the mingw. Latest version of scalpel is 2.0 . You can install it in Ubuntu by typing sudo apt-get install scalpel. After installing it you need to do some text editing. Scalpel utility has its configuration file in the /etc directory with full path as /etc/scalpel/scalpel.conf . When viewed (using gedit/nano/cat) you will notice that everything is a comment out there. Uncomment the file format which you want to recover. For example in my case I want to recover the .zip file so I will uncomment the .zip file section in the scalpel.conf file just like below.

#MISCELLANEOUS
#--------------------------------------------------------------------------------------------------------------
               zip              y                      10000000                      PK\x03\x04                  \x3c\xac
#
#              java           y                      1000000                        \xca\xfe\xba\xbe

After that go to the terminal and follow the syntax :
sudo scalpel <device name/Directory name/file name> -o <ouput directory>

Output directory is the directory where you want to restore your deleted files. It should be empty before running the command, otherwise you will get an error. You can also input the deleted filename directly by using -i option.You can see the screenshot of my device search below .

processing

Although utilities are there to recover your file but I would recommend you guys to put a habit of delete only not of “Shift+Del” because prevention is always better than cure