How to Recover Deleted files in Linux

TestDisk and PhotoRec are two mostly used data recovery software in Linux. Both the software are available for Windows as well. Primarily, these software designed to recover lost partition and make non bootable disks bootable again. Partition table recovery using TestDisk is really very easy.

Test Disk and PhotoRec are open source software. So, you can easily get source code of these and change it as per your requirement.

TestDisk software having following capabilities:

·         Recover deleted partition

·         Recover FAT32/NTFS boot sector from its backup.

·         Locate ext2/ext3/ext4 backup Super Block. (In short, superblock is the block which first loads in memory while reading any file.i.e. first block of file)

·         Copy files from deleted FAT/NTFS and ext2/3/4 partitions.

TestDisk can be available for following Operating System;

·         DOS, Windows2000/XP

·         Windows 7

·         Linux

·         All BSD Operating systems, Sun OS

Want to know steps of recovery from examples then Click here.

For Windows, steps to recover deleted files from NTFS file system.  And to download the TestDisk click here.

TestDisk can find lost partitions for all of these file systems.

·         BSD disk label, compressed File systems.

·         Windows File Systems(FAT16/FAT32/NTFS)

·         Linux btrfs, ext2/3/4 , LUKS encrypted partition, RAID, Swap partition.

·         Sun Solaris label partitions.

·         And many other File systems support this software.

PhotoRec

PhotoRec is software, which is developed to recover lost files including video, lost pictures, documents and archives from hard disks. PhotoRec ignores the file system while recovering files, So it can work even your file system is severely damaged.

                For Security purpose, PhotoRec having read only access to media or Disk. If you have accidently deleted files from your drive then don't write any data on this drive or partition till recovering process completes otherwise your deleted files will be overwrite there with new file. One more thing to take care while using PhotoRec, Don't save recovered files on same partition where you are going to run this software.

PhotoRec supports following file system:

·         FAT, NTFS, exFAT, ext2/ext3/ext4 and HFS+.

PhotoRec supports following Operating Systems:

·         DOS/Windows NT4/2003/XP/7/Vista

·         Linux, all BSD OS, Sun Solaris.

More than 390 extensions supports the PhotoRec for recovering purpose. Some of them are zip, office, pdf, html, jpeg and various graphic file formats. PhotoRec works with hard disks, CD-ROMs, memory cards, USB memory drives, DD raw image.

                It works same as TestDisk i.e. when we delete any file from partition, it will not delete from partition, just its information like file name, date/time, and link to the superblock deletes. This file will be overwrite if you create or copy data to this partition. PhotoRec only find the superblock of the deleted files and whole file will be recovered.

Get step by step information of recovering files by using PhotoRec.

Steps to extend the Volume Group

                Sometimes, If logs are coming in one in LVM partition and you can't stop application or delete logs. So there is only one way to extend the LVM partition. i.e. Extend Logical Volume. But for extending the logical volume, there is need of enough space (our needed free space) in respective Volume group of that logical volume. Following are the simple steps to extend the Volume Group:

Step1: Check the Volume Group details and free space in that. We have 96MB free space in Volume group (MyVolume). But we need more 500MB space in same Volume Group.

[root@server92 ~]#

[root@server92 ~]# vgs

  VG                         #PV       #LV       #SN        Attr        VSize                     VFree

  MyVolume       1              1              0              wz--n-   496.00m               96.00m

  vgsrv                   1              3              0              wz--n-                   4.47g                     384.00m

[root@server92 ~]#

[root@server92 ~]#

Step2: We will create a new LVM partition of 500MB in hard disk in which free space is available and  then we will create its Physical Volume.

[root@server92 ~]# fdisk -cu /dev/sda

Disk /dev/sda: 42.9 GB, 42949672960 bytes

64 heads, 32 sectors/track, 40960 cylinders, total 83886080 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x00050f52

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *        2048      526335      262144   83  Linux

/dev/sda2          526336     9914367     4694016   8e  Linux LVM

/dev/sda3         9914368    10938367      512000    5  Extended

/dev/sda4        10938368    11962367      512000   83  Linux  /// We have already created partition, need

/dev/sda5         9916416    10938367      510976   8e  Linux LVM                                        //to change only type.

Command (m for help): t

Partition number (1-5): 4

Hex code (type L to list codes): 8e

Changed system type of partition 4 to 8e (Linux LVM)

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table. The new table will be used at

the next reboot or after you run partprobe(8) or kpartx(8)

Syncing disks.

[root@server92 ~]#

[root@server92 ~]# partx -a /dev/sda

BLKPG: Device or resource busy

error adding partition 1

BLKPG: Device or resource busy

error adding partition 2

BLKPG: Device or resource busy

error adding partition 3

BLKPG: Device or resource busy

error adding partition 4

BLKPG: Device or resource busy

error adding partition 5

[root@server92 ~]#

[root@server92 ~]# cat /proc/partitions

major minor  #blocks  name

   8        0   41943040 sda

   8        1     262144 sda1

   8        2    4694016 sda2

   8        3          1 sda3

   8        4     512000 sda4

   8        5     510976 sda5

 253        0     557056 dm-0

 253        1    3473408 dm-1

 253        2     409600 dm-2

 253        3     262144 dm-3

[root@server92 ~]#

[root@server92 ~]# pvcreate /dev/sda4

  Physical volume "/dev/sda4" successfully created

[root@server92 ~]#

Step3:  Now add this newly created partition in MyVolume Volume Group. i.e. extend the Volume Group as:

[root@server92 ~]#

[root@server92 ~]# pvs

  PV                        VG       Fmt  Attr PSize   PFree

  /dev/sda2         vgsrv    lvm2 a-     4.47g 384.00m

  /dev/sda4           lvm2 a-   500.00m 500.00m

  /dev/sda5         MyVolume lvm2 a-   496.00m  96.00m

[root@server92 ~]#

[root@server92 ~]# vgextend MyVolume /dev/sda4

  Volume group "MyVolume" successfully extended

[root@server92 ~]#

[root@server92 ~]# vgs

  VG                        #PV #LV #SN Attr   VSize   VFree

  MyVolume       2   1   0 wz--n- 992.00m 592.00m

  vgsrv                   1   3   0 wz--n-   4.47g 384.00m

[root@server92 ~]#

Now, you have free space of 592 MB in Volume group (MyVolume). And you can extend the logical volume by one more command:

[root@server92 ~]# df -kh

Filesystem                                          Size  Used Avail Use% Mounted on

/dev/mapper/vgsrv-root             3.3G  2.1G  1.1G  67% /

tmpfs                                                    246M     0  246M   0% /dev/shm

/dev/sda1                                           248M   30M  206M  13% /boot

/dev/mapper/vgsrv-home           248M   11M  226M   5% /home

/dev/mapper/MyVolume-MyLogicalVol       388M   11M  358M   3% /MyData

[root@server92 ~]#

[root@server92 ~]# lvextend -L +300M /dev/mapper/MyVolume-MyLogicalVol

  Extending logical volume MyLogicalVol to 700.00 MiB

  Logical volume MyLogicalVol successfully resized

[root@server92 ~]#

[root@server92 ~]#

[root@server92 ~]# resize2fs /dev/mapper/MyVolume-MyLogicalVol

resize2fs 1.41.12 (17-May-2010)

Filesystem at /dev/mapper/MyVolume-MyLogicalVol is mounted on /MyData; on-line resizing required

old desc_blocks = 2, new_desc_blocks = 3

Performing an on-line resize of /dev/mapper/MyVolume-MyLogicalVol to 716800 (1k) blocks.

The filesystem on /dev/mapper/MyVolume-MyLogicalVol is now 716800 blocks long.

[root@server92 ~]# df -kh

Filesystem                                          Size  Used Avail Use% Mounted on

/dev/mapper/vgsrv-root             3.3G  2.1G  1.1G  67% /

tmpfs                                                     246M     0  246M   0% /dev/shm

/dev/sda1                                           248M   30M  206M  13% /boot

/dev/mapper/vgsrv-home            248M   11M  226M   5% /home

/dev/mapper/MyVolume-MyLogicalVol       679M   11M  633M   2% /MyData

[root@server92 ~]#

If you want to know more about the Logical Volume extension then click here.

10 Steps To Create a Logical Volume in Linux

Jstat command to check java process statistics                    Jmap command in Linux                     

If you know about Logical Volume Concept in Linux, it will be easier to understand the following steps of creation of logical volume. Before running the following commands need to understand the concept of Physical Volume, Volume Group and Logical Volume.

Step 1: Check the free space in hard disk.

[root@server92 ~]# parted GNU Parted 2.1 Using /dev/sda Welcome to GNU Parted! Type 'help' to view a list of commands. (parted) print free Model: VMware Virtual disk (scsi) Disk /dev/sda: 42.9GB Sector size (logical/physical): 512B/512B Partition Table: msdos Number  Start   End     Size    Type     File system  Flags         32.3kB  1049kB  1016kB           Free Space  1      1049kB  269MB   268MB   primary  ext4         boot  2      269MB   5076MB  4807MB  primary               lvm         5076MB  42.9GB  37.9GB           Free Space (parted) ^C (parted) q [root@server92 ~]#

Step2: Create a new partition in Hard disk in which free space is available. Currently, we have free space of 37.9 GB and it is in /dev/sda hard disk.  You can select last sector as it is or give your value like +1G or +500M .

[root@server92 ~]# fdisk -cu /dev/sda

Command (m for help): n

First sector (9916416-10938367, default 9916416):

Using default value 9916416

Last sector, +sectors or +size{K,M,G} (9916416-10938367, default 10938367):

Using default value 10938367

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table. The new table will be used at

the next reboot or after you run partprobe(8) or kpartx(8)

Syncing disks.

[root@server92 ~]#

[root@server92 ~]#

Recommended Article : 4steps to extend the Logical Volume

Step3: Change the type of partition to 8e (Linux LVM).  You can check all values of Linux File System types by pressing L. for Linux LVM, it need to change as 8e.

[root@server92 ~]#

[root@server92 ~]# fdisk -cu /dev/sda

Command (m for help): p

Disk /dev/sda: 42.9 GB, 42949672960 bytes

64 heads, 32 sectors/track, 40960 cylinders, total 83886080 sectors

Units = sectors of 1 * 512 = 512 bytes

Sector size (logical/physical): 512 bytes / 512 bytes

I/O size (minimum/optimal): 512 bytes / 512 bytes

Disk identifier: 0x00050f52

   Device Boot      Start         End      Blocks   Id  System

/dev/sda1   *        2048      526335      262144   83  Linux

/dev/sda2          526336     9914367     4694016   8e  Linux LVM

/dev/sda3         9914368    10938367      512000    5  Extended

/dev/sda4        10938368    11962367      512000   83  Linux

/dev/sda5         9916416    10938367      510976   83  Linux

Command (m for help): t

Partition number (1-5): 5

Hex code (type L to list codes): 8e

Changed system type of partition 5 to 8e (Linux LVM)

Command (m for help): w

The partition table has been altered!

Calling ioctl() to re-read partition table.

WARNING: Re-reading the partition table failed with error 16: Device or resource busy.

The kernel still uses the old table. The new table will be used at

the next reboot or after you run partprobe(8) or kpartx(8)

Syncing disks.

[root@server92 ~]#

Step4: Save the changes in Linux kernel and check the kernel updated changes or not. Some times , this new created partition is not reflecting in kernel. So, need to run one command and check kernel partition file.

[root@server92 ~]#

[root@server92 ~]# cat /proc/partitions

major minor  #blocks  name

   8        0   41943040 sda

   8        1     262144 sda1

   8        2    4694016 sda2

 253        0     557056 dm-0

 253        1    3473408 dm-1

 253        2     262144 dm-2

[root@server92 ~]# partx -a /dev/sda

BLKPG: Device or resource busy

error adding partition 1

BLKPG: Device or resource busy

error adding partition 2

[root@server92 ~]# partx -a /dev/sda

BLKPG: Device or resource busy

error adding partition 1

BLKPG: Device or resource busy

error adding partition 2

BLKPG: Device or resource busy

error adding partition 3

BLKPG: Device or resource busy

error adding partition 4

BLKPG: Device or resource busy

error adding partition 5

[root@server92 ~]# cat /proc/partitions

major minor  #blocks  name

   8        0   41943040 sda

   8        1     262144 sda1

   8        2    4694016 sda2

   8        3       1024 sda3                                                      // Leave this entry …I was created three partitions so.

   8        4     512000 sda4                                                   // Leave this entry …I was created three partitions so.

   8        5     510976 sda5

 253        0     557056 dm-0

 253        1    3473408 dm-1

 253        2     262144 dm-2

[root@server92 ~]#

Step5: Still, changes are not reflected in kernel then reboot the system.

[root@server92 ~]# reboot

Step6:Now, Create a Physical Volume of new partition i.e. /dev/sda5.

[root@server92 ~]#

[root@server92 ~]# pvcreate /dev/sda5

  Physical volume "/dev/sda5" successfully created

[root@server92 ~]#

[root@server92 ~]# pvdisplay

  --- Physical volume ---

"/dev/sda5" is a new physical volume of "499.00 MiB"

  --- NEW Physical volume ---

  PV Name               /dev/sda5

  VG Name

  PV Size               499.00 MiB

  Allocatable           NO

  PE Size               0

  Total PE              0

  Free PE               0

  Allocated PE          0

  PV UUID               86hSVL-pfhS-K4B1-x1i3-RAV0-ywef-Bhcq9Z    

Step7: If there are more than two physical volumes then you can give both the partition names in command. Create a Volume group of new partition i.e. /dev/sda5. I have created Volume group is MyVolume.

[root@server92 ~]#

[root@server92 ~]# vgcreate MyVolume /dev/sda5

  Volume group "MyVolume" successfully created

[root@server92 ~]#

[root@server92 ~]#

[root@server92 ~]# vgdisplay MyVolume

  --- Volume group ---

  VG Name               MyVolume

  System ID

  Format                lvm2

  Metadata Areas        1

  Metadata Sequence No  1

  VG Access             read/write

  VG Status             resizable

  MAX LV                0

  Cur LV                0

  Open LV               0

  Max PV                0

  Cur PV                1

  Act PV                1

  VG Size               496.00 MiB

  PE Size               4.00 MiB

  Total PE              124

  Alloc PE / Size       0 / 0

  Free  PE / Size       124 / 496.00 MiB

  VG UUID               ZQcrfp-FfVC-3WoP-ev8q-n854-AYEb-ZrPAex

Recommended Article: Steps to extend theVolume Group

Step8: Create a logical Volume from Volume group which you created with required amount of space.

MyLogicalVol – Name of new Logical Volume.

MyVolume— Name of Volume Group which we created and given 300 MB size from that Volume group.

[root@server92 ~]#

[root@server92 ~]# vgs

  VG       #PV #LV #SN Attr   VSize   VFree

  MyVolume   1   0   0 wz--n- 496.00m 496.00m

  vgsrv      1   3   0 wz--n-   4.47g 384.00m

[root@server92 ~]# lvcreate -L 300M -n MyLogicalVol MyVolume

  Logical volume "MyLogicalVol" created                                //-n Name of Logical Volume as per ur choice.

[root@server92 ~]#

Step9: Format the logical volume and mount this new drive.

[root@server92 ~]#

[root@server92 ~]# mkfs.ext4 /dev/mapper/MyVolume-MyLogicalVol

mke2fs 1.41.12 (17-May-2010)

Filesystem label=

OS type: Linux

Block size=1024 (log=0)

Fragment size=1024 (log=0)

Stride=0 blocks, Stripe width=0 blocks

76912 inodes, 307200 blocks

15360 blocks (5.00%) reserved for the super user

First data block=1

Maximum filesystem blocks=67633152

38 block groups

8192 blocks per group, 8192 fragments per group

2024 inodes per group

Superblock backups stored on blocks:

        8193, 24577, 40961, 57345, 73729, 204801, 221185

Writing inode tables: done

Creating journal (8192 blocks): done

Writing superblocks and filesystem accounting information: done

This filesystem will be automatically checked every 39 mounts or

180 days, whichever comes first.  Use tune2fs -c or -i to override.

[root@server92 ~]#

[root@server92 ~]#

[root@server92 ~]# mkdir /MyData

[root@server92 ~]#

[root@server92 ~]# mount /dev/mapper/MyVolume-MyLogicalVol /MyData

[root@server92 ~]#

[root@server92 ~]# df -kh

Filesystem            Size  Used Avail Use% Mounted on

/dev/mapper/vgsrv-root

                      3.3G  2.1G  1.1G  68% /

tmpfs                 246M  260K  246M   1% /dev/shm

/dev/sda1             248M   30M  206M  13% /boot

/dev/mapper/vgsrv-home

                      248M   11M  226M   5% /home

/dev/mapper/MyVolume-MyLogicalVol

                      291M   11M  266M   4% /MyData

[root@server92 ~]#

Step10: For permanent entry in system need to add entry in fstab file.

[root@server92 ~]# vim /etc/fstab

#

# /etc/fstab

# Created by anaconda on Tue Sep 18 10:26:50 2012

#

# Accessible filesystems, by reference, are maintained under '/dev/disk'

# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info

#

/dev/mapper/vgsrv-root  /                       ext4    defaults        1 1

UUID=bd4d2fc3-23ee-4a4d-b829-4a5248a9ae6f /boot                   ext4    defaults        1 2

/dev/mapper/vgsrv-home  /home                   ext4    defaults        1 2

/dev/mapper/vgsrv-swap  swap                    swap    defaults        0 0

tmpfs                   /dev/shm                tmpfs   defaults        0 0

devpts                  /dev/pts                devpts  gid=5,mode=620  0 0

sysfs                   /sys                    sysfs   defaults        0 0

proc                    /proc                   proc    defaults        0 0

/dev/mapper/MyVolume-MyLogicalVol       /MyData ext4    deafults        0 0          //This New Entry

How to install and configure Wine                                Check port details by nc command