{"id":12633,"date":"2019-03-28T04:41:53","date_gmt":"2019-03-28T04:41:53","guid":{"rendered":"http:\/\/www.appservgrid.com\/paw92\/?p=12633"},"modified":"2019-03-28T04:41:53","modified_gmt":"2019-03-28T04:41:53","slug":"install-scalpel-a-filesystem-recovery-tool-to-recover-deleted-files-folders-in-linux","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2019\/03\/28\/install-scalpel-a-filesystem-recovery-tool-to-recover-deleted-files-folders-in-linux\/","title":{"rendered":"Install Scalpel (A Filesystem Recovery Tool) to Recover Deleted Files\/Folders in Linux"},"content":{"rendered":"

Many a times it happens that we accidentally or by mistakenly press \u2018shift + delete<\/strong>\u2018 to files. By human nature you have an habit of using \u2018shift + Del<\/strong>\u2018 instead of using only \u2018Delete<\/strong>\u2018 option. I actually had this incident few days back. I was working on a project and saved my work file in a directory. There were many unwanted files in that directory and needs to be deleted permanently. So I started deleting them one by one. While deleting those files, I accidentally pressed \u2018shift delete<\/strong>\u2018 to one of my important file. The file got deleted permanently from my directory. I was wondering how to recover deleted files and had no clue what to do. I almost spent much time restoring the file but no luck.<\/p>\n

\n

\"Recover<\/a><\/p>\n

Scalpel Recovery Tool For Linux<\/p>\n<\/div>\n

Knowing a bit of technical knowledge I knew about how file system and\u00a0HDD<\/strong>\u00a0works. When you delete a file accidentally, the content of the file does not get deleted from your computer. It is just removed from the database folder and you cannot see the file into the directory, but it still remains in somewhere in your hard drive. Basically the system has a list pointer to blocks on the storage device still has the data. The data is not deleted from the block storage device unless and until you overwrite with a new file. At this point of view I released that my deleted file may still remain somewhere in an unindexed area of the\u00a0Hard disk<\/strong>. However it is recommended to immediately unmount a device as soon as you realize that you have deleted any important file. Unmount helps you to prevent the blocked files from overwritten with new file.<\/p>\n

In this scenario I didn\u2019t want to over write that data, hence I preferred to search in the hard drive without mounting it.<\/p>\n

Normally in\u00a0Windows<\/strong>\u00a0we get tons of 3rd party tools to recovery lost data, but in\u00a0Linux<\/strong>\u00a0only few. However I use\u00a0Ubuntu<\/strong>\u00a0as an operating system and it is very difficult to find a tool that recovers lost file. During my research I got to know about \u2018Scalpel<\/strong>\u2018 a tool that runs through entire hard drive and recovers a lost file. I installed and successfully recovered my lost file with the help of\u00a0Scalpel<\/strong>\u00a0tool. It\u2019s really amazing tool I must say.<\/p>\n

This can also happen with you as well. So I thought of sharing my experience with you. In this article I will show you how to recover deleted files with the help of scalpel tool. So here we go.<\/p>\n

What is Scalpel Tool?<\/h3>\n

Scalpel<\/strong>\u00a0is an open source file system recovery for\u00a0Linux<\/strong>\u00a0and\u00a0Mac<\/strong>\u00a0operation systems. The tool visits the block database storage and identifies the deleted files from it and recover them instantly. Apart from file recovery it is also useful for digital forensics investigation.<\/p>\n

How to Install Scalpel in Debian\/Ubuntu and Linux Mint<\/h3>\n

To Install Scalpel, open terminal by doing \u201cCTrl+Alt+T<\/strong>\u201d from desktop and run the following command.<\/p>\n

$ sudo apt-get install scalpel<\/pre>\n
Sample Output<\/h5>\n
Reading package lists... Done\r\nBuilding dependency tree       \r\nReading state information... Done\r\nThe following NEW packages will be installed:\r\n  scalpel\r\n0 upgraded, 1 newly installed, 0 to remove and 390 not upgraded.\r\nNeed to get 0 B\/33.9 kB of archives.\r\nAfter this operation, 118 kB of additional disk space will be used.\r\nSelecting previously unselected package scalpel.\r\n(Reading database ... 151082 files and directories currently installed.)\r\nUnpacking scalpel (from ...\/scalpel_1.60-1build1_i386.deb) ...\r\nProcessing triggers for man-db ...\r\nSetting up scalpel (1.60-1build1) ...\r\ntecmint@tecmint-Latitude-D630:~$<\/pre>\n
Installing Scalpel in RHEL\/CentOS and Fedora<\/h3>\n
To install scalpel recovery tool, you need to first\u00a0enable epel repository<\/a>. Once it enabled, you can do \u2018yum<\/strong>\u2018 to install it as shown.<\/p>\n
# yum install scalpel<\/pre>\n
Sample Output<\/h5>\n
Loaded plugins: fastestmirror\r\nLoading mirror speeds from cached hostfile\r\n * base: centos.01link.hk\r\n * epel: mirror.nus.edu.sg\r\n * epel-source: mirror.nus.edu.sg\r\nSetting up Install Process\r\nResolving Dependencies\r\n--> Running transaction check\r\n---> Package scalpel.i686 0:2.0-1.el6 will be installed\r\n--> Finished Dependency Resolution\r\n\r\nDependencies Resolved\r\n\r\n==========================================================================================================================================================\r\n Package\t\tArch\t\tVersion\t\t\tRepository\t\tSize\r\n==========================================================================================================================================================\r\nInstalling:\r\n scalpel                i686            2.0-1.el6               epel                    50 k\r\n\r\nTransaction Summary\r\n==========================================================================================================================================================\r\nInstall       1 Package(s)\r\n\r\nTotal download size: 50 k\r\nInstalled size: 108 k\r\nIs this ok [y\/N]: y\r\nDownloading Packages:\r\nscalpel-2.0-1.el6.i686.rpm                                                           |  50 kB     00:00     \r\nRunning rpm_check_debug\r\nRunning Transaction Test\r\nTransaction Test Succeeded\r\nRunning Transaction\r\n  Installing : scalpel-2.0-1.el6.i686\t\t\t\t\t\t\t1\/1 \r\n  Verifying  : scalpel-2.0-1.el6.i686                                                   1\/1 \r\n\r\nInstalled:\r\n  scalpel.i686 0:2.0-1.el6                                                                                                                                \r\n\r\nComplete!<\/pre>\n
Once scalpel is installed you need to do text editing. By default scalpel utility has its own configuration file in \u2018\/etc<\/strong>\u2018 directory and full path is \u201c\/etc\/scalpel\/scalpel.conf<\/strong>\u201d or \u201c\/etc\/scalpel.conf<\/strong>\u201c. You can notice that everything is commented out (#<\/strong>). So before running scalpel you need to uncomment the file format that you need to recover. However uncomment the entire file is time consuming and will generate a huge false results.<\/p>\n
Let say for example I want to recover only \u2018.jpg<\/strong>\u2018 files, so simply uncomment \u2018.jpg<\/strong>\u2018 file section for the scalpel configuration file.<\/p>\n
# GIF and JPG files (very common)\r\n        gif     y       5000000         \\x47\\x49\\x46\\x38\\x37\\x61        \\x00\\x3b\r\n        gif     y       5000000         \\x47\\x49\\x46\\x38\\x39\\x61        \\x00\\x3b\r\n        jpg     y       200000000       \\xff\\xd8\\xff\\xe0\\x00\\x10        \\xff\\xd9<\/pre>\n
Go to terminal and type following syntax. The \u2018\/dev\/sda1<\/strong>\u2018 is a location of a device from where the file is already deleted.<\/p>\n
$ sudo scalpel \/dev\/sda1-o output<\/pre>\n
The \u2018-o<\/strong>\u2018 switch indicates a output directory, where you want to restore your deleted files. Make sure that this directory is empty before running any command otherwise it will give you an error. The output of the above command is.<\/p>\n
Scalpel version 1.60\r\nWritten by Golden G. Richard III, based on Foremost 0.69.\r\n\r\nOpening target \"\/dev\/sda1\"\r\n\r\nImage file pass 1\/2.\r\n\/dev\/sda1:   6.1% |***** \t\t|    6.6 GB    39:16 ETA<\/pre>\n
As you see, the scalpel is now performing its process and it will take time to recovery your deleted file depending upon the disk space that you are trying to scan and the speed of the machine.<\/p>\n
I would recommend you all to have a habit of using only\u00a0delete<\/strong>\u00a0instead of \u201cShift + Delete<\/strong>\u201c. Because as said prevention is always better than cure.<\/p>\n
Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Many a times it happens that we accidentally or by mistakenly press \u2018shift + delete\u2018 to files. By human nature you have an habit of using \u2018shift + Del\u2018 instead of using only \u2018Delete\u2018 option. I actually had this incident few days back. I was working on a project and saved my work file in … <\/p>\n
Continue reading “Install Scalpel (A Filesystem Recovery Tool) to Recover Deleted Files\/Folders in Linux”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-12633","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12633","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/comments?post=12633"}],"version-history":[{"count":1,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12633\/revisions"}],"predecessor-version":[{"id":12634,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/posts\/12633\/revisions\/12634"}],"wp:attachment":[{"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/media?parent=12633"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/categories?post=12633"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.appservgrid.com\/paw92\/index.php\/wp-json\/wp\/v2\/tags?post=12633"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}