Although FAT32 or FAT16 are very old file systems, which is reflected in their poor performance in comparison to other file system alternatives, they are still widely used by many electronic devices. Usually, these devices include USB sticks, digital cameras, camcorders and other peripheral storage devices.
There’s a good chance that you own and store personal data on a device with the FAT filesystem. If you accidentally delete important data from the device, we’ve got good news for you: it can be recovered on Linux.
In this guide, we’ll go over the step by step instructions to recover deleted data from the FAT filesystem on Linux. Read on as we use the
testdisk command to perform file recovery.
In this tutorial you will learn:
- How to create a low level backup of FAT filesystem
- How to install testdisk tool on major Linux distros
- How to use testdisk to recover deleted files from FAT
|Category||Requirements, Conventions or Software Version Used|
|System||Any Linux distro|
|Other||Privileged access to your Linux system as root or via the
# – requires given linux commands to be executed with root privileges either directly as a root user or by use of
$ – requires given linux commands to be executed as a regular non-privileged user
Create a backup of the device
OOPS! I have accidentally removed a video file from my camcorder!
- Before you start to panic, the first thing you should do is unmount the USB device and create a low level backup of the device partition with a
ddcommand (note: replace
/dev/sdXfrom our examples with the name of your own device).
For the sake of this tutorial we will refer to the our block device as
/dev/sdXto avoid any accidental data damage by our readers when following the below text. Therefore, anytime you see eg.
/dev/sdX2we are in fact referring to the actual block device eg.
# umount /dev/sdX
If for any reason you cannot unmount your device, remount it with read-only permissions:
# mount -o remount,ro /dev/sdX
- Any data written or file manipulation after accidental file removal will weaken our chances for deleted file recovery. On the other hand creation of a low level backup with
ddcommand gives us an opportunity for unlimited recovery attempts since we are always able to put the entire partition back bit by bit exactly as it was right after accidental file deletion.
After file deletion from a FAT file system, the actual file was not removed immediately, but the sectors on which the file resides is now available to be overwritten. For this reason a backup of the entire partition:
# dd if=/dev/sdX of=/home/linuxconfig/backup_sdX.dd
- To recover a backup for *.dd file we simply reverse the process:
# dd if=/home/linuxconfig/backup_sdX.dd of=/dev/sdX
testdisk Data Recovery Utility
In this section of the guide, we’ll use the
testdisk utility to perform recovery of deleted files. This application isn’t likely to be installed on your Linux distro by default, so use the appropriate command below to install it.
$ sudo apt install testdisk
$ sudo dnf install testdisk
$ sudo pacman -S testdisk
- To start the undelete process we need to execute
testdiskcommand. Once again, in this example we are using device
/dev/sdX1. You can use the
fdisk -lcommand to identify the device file for your own equipment.
# testdisk /dev/sdX1
- Ensure your devices is selected and press
Enteron the “Proceed” option.
- Select your device’s partition type, which testdisk will attempt to identify itself. Usually we want to select a default partition type since teskdisk by default tries to find the correct partition type. In our case it is the option we need is “none”.
- Select Advanced Filesystem Utils.
- At this stage we need to select a desired partition and choose Undelete.
- At this stage we simply select desired files to recover and hit
ckey to copy into our current directory and answer
y. Once Copy is donem quit from tesdisk utility with the
As you can see, the process of recovering deleted files using testdisk Data Recovery Utility can not be more simple. As a result, both of our test files have been successfully recovered.
In this guide, we learned how to recover deleted files from the FAT filesystem using the testdisk utility. We also saw how to create a low level backup of the filesystem, which we can restore in the event that some deleted files have been overwritten before they could be recoverd. Although FAT is an old filesystem, it remains rather common to this day. Luckily, it’s very simple to recover accidentally deleted files on Linux with testdisk.