Install Scalpel (A Filesystem Recovery Tool) to Recover Deleted Files/Folders in Linux

Many a times it happens that we accidentally or by mistakenly press ‘shift + delete‘ to files. By human nature you have an habit of using ‘shift + Del‘ instead of using only ‘Delete‘ option. I actually had this incident few days back. I was working on a project and saved my work file in a directory. There were many unwanted files in that directory and needs to be deleted permanently. So I started deleting them one by one. While deleting those files, I accidentally pressed ‘shift delete‘ to one of my important file. The file got deleted permanently from my directory. I was wondering how to recover deleted files and had no clue what to do. I almost spent much time restoring the file but no luck.

Recover files in Linux

Scalpel Recovery Tool For Linux

Knowing a bit of technical knowledge I knew about how file system and HDD works. When you delete a file accidentally, the content of the file does not get deleted from your computer. It is just removed from the database folder and you cannot see the file into the directory, but it still remains in somewhere in your hard drive. Basically the system has a list pointer to blocks on the storage device still has the data. The data is not deleted from the block storage device unless and until you overwrite with a new file. At this point of view I released that my deleted file may still remain somewhere in an unindexed area of the Hard disk. However it is recommended to immediately unmount a device as soon as you realize that you have deleted any important file. Unmount helps you to prevent the blocked files from overwritten with new file.

In this scenario I didn’t want to over write that data, hence I preferred to search in the hard drive without mounting it.

Normally in Windows we get tons of 3rd party tools to recovery lost data, but in Linux only few. However I use Ubuntu as an operating system and it is very difficult to find a tool that recovers lost file. During my research I got to know about ‘Scalpel‘ a tool that runs through entire hard drive and recovers a lost file. I installed and successfully recovered my lost file with the help of Scalpel tool. It’s really amazing tool I must say.

This can also happen with you as well. So I thought of sharing my experience with you. In this article I will show you how to recover deleted files with the help of scalpel tool. So here we go.

What is Scalpel Tool?

Scalpel is an open source file system recovery for Linux and Mac operation systems. The tool visits the block database storage and identifies the deleted files from it and recover them instantly. Apart from file recovery it is also useful for digital forensics investigation.

How to Install Scalpel in Debian/Ubuntu and Linux Mint

To Install Scalpel, open terminal by doing “CTrl+Alt+T” from desktop and run the following command.

$ sudo apt-get install scalpel
Sample Output
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  scalpel
0 upgraded, 1 newly installed, 0 to remove and 390 not upgraded.
Need to get 0 B/33.9 kB of archives.
After this operation, 118 kB of additional disk space will be used.
Selecting previously unselected package scalpel.
(Reading database ... 151082 files and directories currently installed.)
Unpacking scalpel (from .../scalpel_1.60-1build1_i386.deb) ...
Processing triggers for man-db ...
Setting up scalpel (1.60-1build1) ...
[email protected]:~$

Installing Scalpel in RHEL/CentOS and Fedora

To install scalpel recovery tool, you need to first enable epel repository. Once it enabled, you can do ‘yum‘ to install it as shown.

# yum install scalpel
Sample Output
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.01link.hk
 * epel: mirror.nus.edu.sg
 * epel-source: mirror.nus.edu.sg
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package scalpel.i686 0:2.0-1.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

==========================================================================================================================================================
 Package		Arch		Version			Repository		Size
==========================================================================================================================================================
Installing:
 scalpel                i686            2.0-1.el6               epel                    50 k

Transaction Summary
==========================================================================================================================================================
Install       1 Package(s)

Total download size: 50 k
Installed size: 108 k
Is this ok [y/N]: y
Downloading Packages:
scalpel-2.0-1.el6.i686.rpm                                                           |  50 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : scalpel-2.0-1.el6.i686							1/1 
  Verifying  : scalpel-2.0-1.el6.i686                                                   1/1 

Installed:
  scalpel.i686 0:2.0-1.el6                                                                                                                                

Complete!

Once scalpel is installed you need to do text editing. By default scalpel utility has its own configuration file in ‘/etc‘ directory and full path is “/etc/scalpel/scalpel.conf” or “/etc/scalpel.conf“. You can notice that everything is commented out (#). So before running scalpel you need to uncomment the file format that you need to recover. However uncomment the entire file is time consuming and will generate a huge false results.

Let say for example I want to recover only ‘.jpg‘ files, so simply uncomment ‘.jpg‘ file section for the scalpel configuration file.

# GIF and JPG files (very common)
        gif     y       5000000         \x47\x49\x46\x38\x37\x61        \x00\x3b
        gif     y       5000000         \x47\x49\x46\x38\x39\x61        \x00\x3b
        jpg     y       200000000       \xff\xd8\xff\xe0\x00\x10        \xff\xd9

Go to terminal and type following syntax. The ‘/dev/sda1‘ is a location of a device from where the file is already deleted.

$ sudo scalpel /dev/sda1-o output

The ‘-o‘ switch indicates a output directory, where you want to restore your deleted files. Make sure that this directory is empty before running any command otherwise it will give you an error. The output of the above command is.

Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "/dev/sda1"

Image file pass 1/2.
/dev/sda1:   6.1% |***** 		|    6.6 GB    39:16 ETA

As you see, the scalpel is now performing its process and it will take time to recovery your deleted file depending upon the disk space that you are trying to scan and the speed of the machine.

I would recommend you all to have a habit of using only delete instead of “Shift + Delete“. Because as said prevention is always better than cure.

Best Affordable Linux and WordPress Services For Your Business
Outsource Your Linux and WordPress Project and Get it Promptly Completed Remotely and Delivered Online.

If You Appreciate What We Do Here On TecMint, You Should Consider:

  1. Stay Connected to: Twitter | Facebook | Google Plus
  2. Subscribe to our email updates: Sign Up Now
  3. Get your own self-hosted blog with a Free Domain at ($3.45/month).
  4. Become a Supporter - Make a contribution via PayPal
  5. Support us by purchasing our premium books in PDF format.
  6. Support us by taking our online Linux courses

We are thankful for your never ending support.

RedHat RHCE and RHCSA Certification Book
Linux Foundation LFCS and LFCE Certification Preparation Guide

You may also like...

24 Responses

  1. Kaiser_Y says:

    You guys have to edit the scalpel.conf file first. It won’t run because by default there’s no file types for it to find. It’s written here up above “YOU HAVE TO UNCOMMENT THE FILE FORMAT”.

    • Ravi Saive says:

      @Kaiser,

      Thanks for sharing the useful tip, hope it will helpful other users define file types before running the scalpel to recover deleted files..

  2. abc says:

    Opening target “/home/vagrant/GIT/BST”

    ERROR: The configuration file didn’t specify any file types to carve.
    (If you’re using the default configuration file, you’ll have to
    uncomment some of the file types.)

    See /etc/scalpel/scalpel.conf.

    getting this error again n again

  3. Rohtash kumar says:

    I have installed scalpel, but this not working and give the error

    Scalpel version 2.0
    Written by Golden G. Richard III and Lodovico Marziale.
    ERROR: Couldn't open configuration file:
    scalpel.conf -- No such file or directory
    Scalpel was unable to read a needed file and will abort.
    

    what the solution of this….?

  4. Eldad says:

    Hi there is option to restore any files
    the NONE options should work for any ?

    actually im wonder how to restore py (python) files

  5. Tarun says:

    Most of them are command mode…testdisk and photorec and not very helpfull. tried backbox but unsuccessfull since they are in command mode and tough to know syntax for same. any other free gui recovery options for formatted or bad hard disks. pls ctct johntarun ate gmail

  6. Alex says:

    GUI based Linux recovery tool would be helpful. However, I’d prefer to use GUI based recovery tools and that’s why found a great tool entitled, Stellar Phoenix Linux Recovery Software.

    http://www.stellarinfo.com/linux-data-recovery.htm

    Hope it helps to someone who is not comfortable with using command based Linux recovery tools.

Got something to say? Join the discussion.

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.