Recover Deleted Files Using Linux

One of my neighbours came to me a couple of days ago with a problem… he’d lost his CV to a windows virus and had no backup. So I said I’d try to recover the file for him. A quick google led me to Foremost. I chose foremost because it’s small, fast and easy to use. Since this was a file recovery operation, I decided to minimize the risk of the deleted file being overwritten by creating a disk image of the pen drive. A quick

dd if=/dev/sdb of=recover.iso

did the trick.

Then it was a simple matter of

sudo apt-get install foremost

to install foremost and then…

foremost -t doc recover.iso

The ‘-t doc’  parameter tells foremost to look for only Microsoft Word files. About a minute later, the thing was done and the files were back. For what it’s worth, if you accidentally delete a file, it’s a very bad idea to continue using the computer. Shut down the pc or disconnect the drive immediately and look for a linux rescue cd. 😀