Data recovery of deleted files from the FAT filesystem

Although FAT32 or FAT16 are very old file systems, which is reflected in their poor performance in comparison to other file system alternatives, they are still widely used by many electronic devices. Usually, these devices include USB sticks, digital cameras, camcorders and other peripheral storage devices.

There’s a good chance that you own and store personal data on a device with the FAT filesystem. If you accidentally delete important data from the device, we’ve got good news for you: it can be recovered on Linux.

In this guide, we’ll go over the step by step instructions to recover deleted data from the FAT filesystem on Linux. Read on as we use the testdisk command to perform file recovery.

In this tutorial you will learn:

  • How to create a low level backup of FAT filesystem
  • How to install testdisk tool on major Linux distros
  • How to use testdisk to recover deleted files from FAT

Recovering deleted files from a FAT filesystem on Linux

Recovering deleted files from a FAT filesystem on Linux

Software Requirements and Linux Command Line Conventions
Category Requirements, Conventions or Software Version Used
System Any Linux distro
Software testdisk
Other Privileged access to your Linux system as root or via the sudo command.
Conventions # – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command
$ – requires given linux commands to be executed as a regular non-privileged user

Create a backup of the device



OOPS! I have accidentally removed a video file from my camcorder!

  1. Before you start to panic, the first thing you should do is unmount the USB device and create a low level backup of the device partition with a dd command (note: replace /dev/sdX from our examples with the name of your own device).
    PLEASE READ
    For the sake of this tutorial we will refer to the our block device as /dev/sdX to avoid any accidental data damage by our readers when following the below text. Therefore, anytime you see eg. /dev/sdX or /dev/sdX2 we are in fact referring to the actual block device eg. /dev/sdb and partition /dev/sdb2 respectively.
    # umount /dev/sdX
    

    If for any reason you cannot unmount your device, remount it with read-only permissions:

    # mount -o remount,ro /dev/sdX
    
  2. Any data written or file manipulation after accidental file removal will weaken our chances for deleted file recovery. On the other hand creation of a low level backup with dd command gives us an opportunity for unlimited recovery attempts since we are always able to put the entire partition back bit by bit exactly as it was right after accidental file deletion.

    After file deletion from a FAT file system, the actual file was not removed immediately, but the sectors on which the file resides is now available to be overwritten. For this reason a backup of the entire partition:

    # dd if=/dev/sdX of=/home/linuxconfig/backup_sdX.dd
    
  3. To recover a backup for *.dd file we simply reverse the process:
    # dd if=/home/linuxconfig/backup_sdX.dd of=/dev/sdX
    

testdisk Data Recovery Utility

In this section of the guide, we’ll use the testdisk utility to perform recovery of deleted files. This application isn’t likely to be installed on your Linux distro by default, so use the appropriate command below to install it.

To install testdisk on Ubuntu, Debian, and Linux Mint:

$ sudo apt install testdisk

To install testdisk on CentOS, Fedora, AlmaLinux, and Red Hat:

$ sudo dnf install testdisk


To install testdisk on Arch Linux and Manjaro:

$ sudo pacman -S testdisk
  1. To start the undelete process we need to execute testdisk command. Once again, in this example we are using device /dev/sdX1. You can use the fdisk -l command to identify the device file for your own equipment.
    # testdisk /dev/sdX1
    
  2. Ensure your devices is selected and press Enter on the “Proceed” option.
  3. Select your partition and choose proceed

    Select your partition and choose proceed

  4. Select your device’s partition type, which testdisk will attempt to identify itself. Usually we want to select a default partition type since teskdisk by default tries to find the correct partition type. In our case it is the option we need is “none”.
  5. Select your partition type, preferably whatever testdisk detects

    Select your partition type, preferably whatever testdisk detects

  6. Select Advanced Filesystem Utils.
  7. Choose advanced filesysem utilities

    Choose advanced filesysem utilities

  8. At this stage we need to select a desired partition and choose Undelete.
  9. Choose the undelete option to see a list of files that have been deleted

    Choose the undelete option to see a list of files that have been deleted

  10. At this stage we simply select desired files to recover and hit c key to copy into our current directory and answer y. Once Copy is donem quit from tesdisk utility with the q key.
  11. Select all the files that you wish to recover

    Select all the files that you wish to recover



As you can see, the process of recovering deleted files using testdisk Data Recovery Utility can not be more simple. As a result, both of our test files have been successfully recovered.

Closing Thoughts

In this guide, we learned how to recover deleted files from the FAT filesystem using the testdisk utility. We also saw how to create a low level backup of the filesystem, which we can restore in the event that some deleted files have been overwritten before they could be recoverd. Although FAT is an old filesystem, it remains rather common to this day. Luckily, it’s very simple to recover accidentally deleted files on Linux with testdisk.



Comments and Discussions
Linux Forum