You can recover a deleted file on Linux, but only if you act before the disk space gets reused

When you delete a file on Linux, the operating system does not erase the actual data from your hard drive — it just marks that space as available for new files. Until something else writes over it, the original data is still there. Tools like testdisk, photorec, and extundelete can scan your disk and find those deleted files before they are overwritten.

The catch is timing. On a busy system, new files get written constantly. The longer you wait, the more likely your deleted file has been partially or completely overwritten. If you deleted something important, stop using the computer when ready and start recovery as soon as you can.

The method you use depends on what kind of drive you have (traditional hard drive or SSD), what file system you are running (ext4, ext3, btrfs, or another), and whether you have physical access to the machine. Some approaches work from the command line on the same system; others require you to boot from a separate drive to avoid writing new data to the disk you are trying to recover from.

Key Takeaways

  • Stop using your computer when ready after deleting a file you need — every new file written to disk reduces the chance of recovery.
  • For ext4 file systems, extundelete is the most straightforward tool and works from the command line without rebooting.
  • For other file systems or when you need to recover many files at once, boot from a live USB with testdisk or photorec to avoid overwriting data.
  • SSDs are much harder to recover from than traditional hard drives because they handle deleted space differently — recovery is possible but less reliable.
  • If the file system itself is damaged or you are not comfortable with the command line, a professional recovery service can help, though it costs money.

How to check what file system you are using

Before you choose a recovery tool, you need to know what file system your drive uses. Open a terminal and type df -T. The output will show you each mounted drive and its file system type — usually ext4, ext3, btrfs, xfs, or ntfs.

If you deleted the file from your main drive (where your operating system lives), note the file system type for that partition. If you deleted it from an external drive or a second internal drive, check the type for that one instead. The recovery method changes depending on this information.

Recovering a deleted file from ext4 using extundelete

extundelete is the easiest recovery tool for ext4 file systems, which is what most Linux systems use by default. It works directly from the command line without requiring a reboot, and it can recover individual files or entire directories.

First, install extundelete. On Ubuntu or Debian, type sudo apt install extundelete. On Fedora or Red Hat systems, type sudo dnf install extundelete. On Arch, type sudo pacman -S extundelete.

Once installed, you need to know the device name of the drive where you deleted the file. Type lsblk to see all your drives and partitions. Look for the one that matches your drive size — it will be something like /dev/sda1 or /dev/nvme0n1p2. Do not guess; using the wrong device will corrupt data on that drive.

To search for deleted files, type sudo extundelete /dev/sda1 --inode 2 --restore-all (replace /dev/sda1 with your actual device). This scans the entire partition and recovers everything it finds into a folder called RECOVERED_FILES in your current directory. The process can take several minutes on a large drive.

If you want to recover only a specific file, you can search by name first: sudo extundelete /dev/sda1 --inode 2 | grep filename (replace filename with the name of the file you deleted). Once you find it, use the --restore-file option to recover just that one.

Recovering files from other file systems using testdisk and photorec

testdisk and photorec work on almost any file system — ext3, ext4, btrfs, xfs, ntfs, and many others. They are more powerful than extundelete but also more complex to use. photorec is the recovery tool; testdisk is a companion that can fix partition tables if your drive structure is damaged.

The safest way to use these tools is to boot from a live USB so you do not accidentally write new data to the drive you are trying to recover from. read a Linux live image (Ubuntu, Fedora, or any distribution) and write it to a USB drive using Etcher or dd. Boot from that USB, then install testdisk and photorec from the live system's package manager.

Once you have photorec running, it will show you a list of drives and partitions. Select the drive or partition where you deleted the file. Choose the file system type from the menu. photorec will then scan the entire partition and display a list of recoverable files, organized by type (documents, images, videos, and so on). You can select which files to recover and where to save them.

The downside is that photorec does not always preserve the original file names or folder structure — it assigns generic names like f0000001.jpg and sorts files by type instead. For a few deleted files, this is manageable. For hundreds or thousands, it becomes tedious.

Why SSDs are harder to recover from

Solid-state drives handle deleted files differently than traditional hard drives. When you delete a file on an SSD, the drive may when ready erase the data as part of its wear-leveling process — a feature that spreads writes evenly across the drive to extend its lifespan. This means recovery tools may find nothing to recover, even seconds after deletion.

Some SSDs support a feature called TRIM, which tells the drive that deleted space is available for reuse. If TRIM is enabled (which it usually is on modern Linux systems), deleted files disappear much faster. You can check if TRIM is running by typing sudo fstrim -v / — if it completes without error, TRIM is active.

Recovery from an SSD is still possible, especially if you act very quickly, but it is less reliable than recovery from a traditional hard drive. If the file is critical and you have an SSD, consider stopping all disk activity and consulting a professional recovery service instead of trying tools yourself.

What to do if you cannot recover the file yourself

If the file system is damaged, the drive is making clicking or grinding sounds, or you are not comfortable using the command line, a professional data recovery service can help. These services have specialized equipment and can recover files even from physically damaged drives. The cost ranges widely depending on the damage and the amount of data, but expect to pay several hundred dollars at minimum.

Before you send a drive to a recovery service, do not open it yourself or attempt repairs. Physical damage inside the drive can make recovery impossible. Ship it in a padded box and include a description of what happened — whether it was deleted, dropped, exposed to water, or something else.

How to prevent this from happening again

The best recovery tool is a backup made before you delete something. Set up automated backups using rsync, Timeshift, or a cloud service so that deleted files are always recoverable from a previous snapshot. Many Linux users also use a trash system that moves deleted files to a hidden folder instead of erasing them when ready — this gives you a second chance to restore them before they are permanently gone.

If you are working with important files, consider using version control like git to track changes. This way, even if you delete a file by accident, you can check it out from your repository. For everyday use, a straightforward weekly backup to an external drive or cloud storage prevents most data loss emergencies.

Frequently Asked Questions

How long do I have to recover a deleted file?

It depends on how much new data gets written to your drive. On a quiet system, you might have days or weeks. On a busy system, hours or minutes. The moment you realize you deleted something important, stop using the computer and start recovery when ready. Every file saved, email downloaded, or system update written reduces your chances.

Will recovery tools work if I emptied the trash?

Yes. Emptying the trash just removes the file from the trash folder — it does not erase the underlying data. The recovery process is the same whether you deleted the file directly or emptied it from trash afterward.

Can I recover a file if I have already shut down and restarted my computer?

Yes, as long as you have not used the computer much since the restart. The data is still on the disk. However, the shutdown and restart process may have written some new files, so act quickly. Do not install software, read files, or run updates — each action reduces recovery chances.

What if extundelete says "Permission denied"?

You need to run it with sudo to access the raw disk. Type sudo extundelete instead of just extundelete. If you still get an error, the partition may be mounted (in use by the system). You may need to boot from a live USB to recover from a mounted partition safely.

Can I recover files from an encrypted drive?

Only if you know the encryption password. Recovery tools can find the deleted data, but they cannot decrypt it without the key. If you encrypted your drive and forgot the password, recovery becomes much harder and may require professional help.