File recovery on Linux depends heavily on the filesystem, storage device, and what happened after deletion. The most important first step is to avoid writing more data to the affected filesystem.
Stop writes first
- Stop applications that may continue writing to the filesystem.
- Unmount the filesystem if it can be done safely.
- For important data, work from a block-level image or clone rather than experimenting directly on the original device.
Recovery options vary
Traditional tools such as testdisk and photorec can help in some cases, while filesystem-specific tools may be available for certain ext filesystems. Success is never guaranteed, especially after blocks have been reused.
SSD warning
On SSDs, TRIM can make deleted blocks unavailable to recovery software quickly. If the data is genuinely valuable, minimise activity and consider professional recovery rather than repeatedly scanning or mounting the device.
Backups remain the most reliable recovery method; undelete tools should be treated as a last resort, not a substitute for backups.