Although FAT32 or FAT16 are very old file systems, which is reflected in their poor performance in comparison to other file system alternatives, they are still widely used by many electronic devices. Usually, these devices include USB sticks, digital cameras, camcorders and other peripheral storage devices.
There’s a good chance that you own and store personal data on a device with the FAT filesystem. If you accidentally delete important data from the device, we’ve got good news for you: it can be recovered on Linux.
In this guide, we’ll go over the step by step instructions to recover deleted data from the FAT filesystem on Linux. Read on as we use the testdisk
command to perform file recovery.
In this tutorial you will learn:
- How to create a low level backup of FAT filesystem
- How to install testdisk tool on major Linux distros
- How to use testdisk to recover deleted files from FAT
Category | Requirements, Conventions or Software Version Used |
---|---|
System | Any Linux distro |
Software | testdisk |
Other | Privileged access to your Linux system as root or via the sudo command. |
Conventions |
# – requires given linux commands to be executed with root privileges either directly as a root user or by use of sudo command$ – requires given linux commands to be executed as a regular non-privileged user |
Create a backup of the device
OOPS! I have accidentally removed a video file from my camcorder!
- Before you start to panic, the first thing you should do is unmount the USB device and create a low level backup of the device partition with a
dd
command (note: replace/dev/sdX
from our examples with the name of your own device).PLEASE READ
For the sake of this tutorial we will refer to the our block device as/dev/sdX
to avoid any accidental data damage by our readers when following the below text. Therefore, anytime you see eg./dev/sdX
or/dev/sdX2
we are in fact referring to the actual block device eg./dev/sdb
and partition/dev/sdb2
respectively.# umount /dev/sdX
If for any reason you cannot unmount your device, remount it with read-only permissions:
# mount -o remount,ro /dev/sdX
- Any data written or file manipulation after accidental file removal will weaken our chances for deleted file recovery. On the other hand creation of a low level backup with
dd
command gives us an opportunity for unlimited recovery attempts since we are always able to put the entire partition back bit by bit exactly as it was right after accidental file deletion.After file deletion from a FAT file system, the actual file was not removed immediately, but the sectors on which the file resides is now available to be overwritten. For this reason a backup of the entire partition:
# dd if=/dev/sdX of=/home/linuxconfig/backup_sdX.dd
- To recover a backup for *.dd file we simply reverse the process:
# dd if=/home/linuxconfig/backup_sdX.dd of=/dev/sdX
testdisk Data Recovery Utility
In this section of the guide, we’ll use the testdisk
utility to perform recovery of deleted files. This application isn’t likely to be installed on your Linux distro by default, so use the appropriate command below to install it.
To install testdisk on Ubuntu, Debian, and Linux Mint:
$ sudo apt install testdisk
To install testdisk on CentOS, Fedora, AlmaLinux, and Red Hat:
$ sudo dnf install testdisk
To install testdisk on Arch Linux and Manjaro:
$ sudo pacman -S testdisk
- To start the undelete process we need to execute
testdisk
command. Once again, in this example we are using device/dev/sdX1
. You can use thefdisk -l
command to identify the device file for your own equipment.# testdisk /dev/sdX1
- Ensure your devices is selected and press
Enter
on the “Proceed” option. - Select your device’s partition type, which testdisk will attempt to identify itself. Usually we want to select a default partition type since teskdisk by default tries to find the correct partition type. In our case it is the option we need is “none”.
- Select Advanced Filesystem Utils.
- At this stage we need to select a desired partition and choose Undelete.
- At this stage we simply select desired files to recover and hit
c
key to copy into our current directory and answery
. Once Copy is donem quit from tesdisk utility with theq
key.
As you can see, the process of recovering deleted files using testdisk Data Recovery Utility can not be more simple. As a result, both of our test files have been successfully recovered.
Closing Thoughts
In this guide, we learned how to recover deleted files from the FAT filesystem using the testdisk utility. We also saw how to create a low level backup of the filesystem, which we can restore in the event that some deleted files have been overwritten before they could be recoverd. Although FAT is an old filesystem, it remains rather common to this day. Luckily, it’s very simple to recover accidentally deleted files on Linux with testdisk.