Recovering Files from a Computer that you just Installed Linux on (or otherwise wiped)

As someone who frequently installs new Linux distros on lots of different systems, I am no stranger to the process of packing up old files, wiping hard drives, and moving files back onto a device. However, recently I learned a very valuable lesson from a Linux install gone sour. I backed up all my files onto an external ssd, wiped my laptop, and installed the latest version of Linux Mint. Once the install process had finished, I plugged in the external drive and began copying files back over to the laptop. Mid way through the transfer an error message popped up. I unplugged the drive and when I plugged it back in the laptop was unaware that a new device had been plugged in. The drive died leaving me with just a small ounce of hope that I could recover any files that weren’t written over.

Using PhotoRec to Save Lost Files

The first thing to do after something like this happens is to turn off your laptop. You don’t want any files that may still be present on your hard drive to be overwritten. Next, grab an unused USB flash drive and create a bootable image of any lightweight distribution. I used Lubuntu which worked great.

Link can be found here: Lubuntu Download →

Turn your computer on, interrupt start-up by entering the bios menu, and set the boot order to prioritize the USB.

Once you have booted into Lubuntu issue this command:

sudo apt install testdisk

TestDisk is a utility program designed to recover lost or damaged partition tables. When I ran test disk on my system it didn’t result in any meaningful data recovery. However, testdisk comes with another tool called PhotoRec. The PhotoRec tool searches all blocks on a specified disk determining if the data found is any of a large list of file formats. This is what makes it ideal for recovering data after a Linux install.

Before running PhotoRec, I recommend changing the power saving and sleep timer settings on your device. PhotoRec scans can take a very long time, especially if you have a large hard drive. In my experience (again I was on Lubuntu) the scan was not interrupted even if the screensaver appeared, but I would change these settings just to be safe. For reference, my scan took around 24 hours to complete, working on only a single 1 TB HDD.

I also recommend grabbing a second USB stick, to store the recovered files on. Make sure it is plugged in before beginning this process.

To start the program run:

sudo photorec

The program will prompt you to select a disk. The best way to determine which disk is correct if you have multiple listed is to look at the size of each drive.

Once you have selected a disk, it will ask which filesystem type it should look for. If you are recovering windows data choose NTFS. If you are recovering linux data choose ext4.

Next, select a destination directory. Choose the extra USB drive you have plugged in. You should be able to find it at:

/media/lubuntu/YOUR_USB_NAME

After selecting your destination, the file recovery should start. Remember that this will take a very long time, so be patient.

After the scan finishes you will be left with hundreds of folders of recovered files. These files are completely unsorted and in my experience the majority of them will be temoporary images your computer downloaded from the web. For this reason, I wrote a small script that creates three folders: png, jpg, and doc. The script loops through all the folders that have been recovered and deposits any files with the correct extension into its respective folder.

Here is the script for your use:

#!/bin/bash
parent_folder=FILL IN YOUR USB DRIVE PATH HERE
echo $parent_folder
cd $parent_folder
mkdir jpg
mkdir png
mkdir doc 


for dir in */ 
do
    cd $parent_folder
    echo Moving to $parent_folder/$dir 
    cd $dir
    for FILE in *
    do
	echo Sorting $FILE
    ext="${FILE##*.}"
        if [[ $ext == jpg ]]
        then
            cp $FILE $parent_folder/jpg/
        fi
        if [[ $ext == png ]]
        then 
            cp $FILE $parent_folder/png/
        fi
        if [[ $ext == pdf ]]
	    then
            cp $FILE $parent_folder/doc/
        fi
        if [[ $ext == doc ]]
	    then
            cp $FILE $parent_folder/doc/
        fi
    done
done

Don’t run this script from the USB you are saving recovered files to. Linux will not allow you to execute files on a mounted USB without a bit of extra work. For simplicity’s sake you should just place the script somewhere on the bootable USB’s file system and run it from there.

After the script has finished, you should examine the sorted folders. I recommend using the file explorer to sort by file size. This will keep the temporary files which are low resolution at the bottom of the list. Flip through your files and make sure the tool recovered your files before moving forward.

Using this method I was able to recover over 5000 images and around 100 pdfs. Unfortunately, all of the word document files my system recovered were corrupted, be warned.