Install Scalpel (A Filesystem Recovery Tool) to Recover Deleted Files/Folders in Linux

Many a times it happens that we accidentally or by mistakenly press ‘shift + delete‘ to files. By human nature you have an habit of using ‘shift + Del‘ instead of using only ‘Delete‘ option. I actually had this incident few days back. I was working on a project and saved my work file in a directory. There were many unwanted files in that directory and needs to be deleted permanently. So I started deleting them one by one. While deleting those files, I accidentally pressed ‘shift delete‘ to one of my important file. The file got deleted permanently from my directory. I was wondering how to recover deleted files and had no clue what to do. I almost spent much time restoring the file but no luck.

Recover files in Linux
Scalpel Recovery Tool For Linux

Knowing a bit of technical knowledge I knew about how file system and HDD works. When you delete a file accidentally, the content of the file does not get deleted from your computer. It is just removed from the database folder and you cannot see the file into the directory, but it still remains in somewhere in your hard drive. Basically the system has a list pointer to blocks on the storage device still has the data. The data is not deleted from the block storage device unless and until you overwrite with a new file. At this point of view I released that my deleted file may still remain somewhere in an unindexed area of the Hard disk. However it is recommended to immediately unmount a device as soon as you realize that you have deleted any important file. Unmount helps you to prevent the blocked files from overwritten with new file.

In this scenario I didn’t want to over write that data, hence I preferred to search in the hard drive without mounting it.

Normally in Windows we get tons of 3rd party tools to recovery lost data, but in Linux only few. However I use Ubuntu as an operating system and it is very difficult to find a tool that recovers lost file. During my research I got to know about ‘Scalpel‘ a tool that runs through entire hard drive and recovers a lost file. I installed and successfully recovered my lost file with the help of Scalpel tool. It’s really amazing tool I must say.

This can also happen with you as well. So I thought of sharing my experience with you. In this article I will show you how to recover deleted files with the help of scalpel tool. So here we go.

What is Scalpel Tool?

Scalpel is an open source file system recovery for Linux and Mac operation systems. The tool visits the block database storage and identifies the deleted files from it and recover them instantly. Apart from file recovery it is also useful for digital forensics investigation.

How to Install Scalpel in Debian/Ubuntu and Linux Mint

To Install Scalpel, open terminal by doing “CTrl+Alt+T” from desktop and run the following command.

$ sudo apt-get install scalpel
Sample Output
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
0 upgraded, 1 newly installed, 0 to remove and 390 not upgraded.
Need to get 0 B/33.9 kB of archives.
After this operation, 118 kB of additional disk space will be used.
Selecting previously unselected package scalpel.
(Reading database ... 151082 files and directories currently installed.)
Unpacking scalpel (from .../scalpel_1.60-1build1_i386.deb) ...
Processing triggers for man-db ...
Setting up scalpel (1.60-1build1) ...

Installing Scalpel in RHEL/CentOS and Fedora

To install scalpel recovery tool, you need to first enable epel repository. Once it enabled, you can do ‘yum‘ to install it as shown.

# yum install scalpel
Sample Output
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base:
 * epel:
 * epel-source:
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package scalpel.i686 0:2.0-1.el6 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

 Package		Arch		Version			Repository		Size
 scalpel                i686            2.0-1.el6               epel                    50 k

Transaction Summary
Install       1 Package(s)

Total download size: 50 k
Installed size: 108 k
Is this ok [y/N]: y
Downloading Packages:
scalpel-2.0-1.el6.i686.rpm                                                           |  50 kB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : scalpel-2.0-1.el6.i686							1/1 
  Verifying  : scalpel-2.0-1.el6.i686                                                   1/1 

  scalpel.i686 0:2.0-1.el6                                                                                                                                


Once scalpel is installed you need to do text editing. By default scalpel utility has its own configuration file in ‘/etc‘ directory and full path is “/etc/scalpel/scalpel.conf” or “/etc/scalpel.conf“. You can notice that everything is commented out (#). So before running scalpel you need to uncomment the file format that you need to recover. However uncomment the entire file is time consuming and will generate a huge false results.

Let say for example I want to recover only ‘.jpg‘ files, so simply uncomment ‘.jpg‘ file section for the scalpel configuration file.

# GIF and JPG files (very common)
        gif     y       5000000         \x47\x49\x46\x38\x37\x61        \x00\x3b
        gif     y       5000000         \x47\x49\x46\x38\x39\x61        \x00\x3b
        jpg     y       200000000       \xff\xd8\xff\xe0\x00\x10        \xff\xd9

Go to terminal and type following syntax. The ‘/dev/sda1‘ is a location of a device from where the file is already deleted.

$ sudo scalpel /dev/sda1-o output

The ‘-o‘ switch indicates a output directory, where you want to restore your deleted files. Make sure that this directory is empty before running any command otherwise it will give you an error. The output of the above command is.

Scalpel version 1.60
Written by Golden G. Richard III, based on Foremost 0.69.

Opening target "/dev/sda1"

Image file pass 1/2.
/dev/sda1:   6.1% |***** 		|    6.6 GB    39:16 ETA

As you see, the scalpel is now performing its process and it will take time to recovery your deleted file depending upon the disk space that you are trying to scan and the speed of the machine.

I would recommend you all to have a habit of using only delete instead of “Shift + Delete“. Because as said prevention is always better than cure.

If you read this far, tweet to the author to show them you care. Tweet a thanks
Anusha Saive
Anusha worked for many years in the IT industry as a Project Manager, and also a senior writer and editor at Tecmint. She is a huge fan of Linux and is passionate about writing Linux and technology-related stuff.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.

25 thoughts on “Install Scalpel (A Filesystem Recovery Tool) to Recover Deleted Files/Folders in Linux”

  1. You guys have to edit the scalpel.conf file first. It won’t run because by default there’s no file types for it to find. It’s written here up above “YOU HAVE TO UNCOMMENT THE FILE FORMAT”.

    • @Kaiser,

      Thanks for sharing the useful tip, hope it will helpful other users define file types before running the scalpel to recover deleted files..

  2. Opening target “/home/vagrant/GIT/BST”

    ERROR: The configuration file didn’t specify any file types to carve.
    (If you’re using the default configuration file, you’ll have to
    uncomment some of the file types.)

    See /etc/scalpel/scalpel.conf.

    getting this error again n again

  3. I have installed scalpel, but this not working and give the error

    Scalpel version 2.0
    Written by Golden G. Richard III and Lodovico Marziale.
    ERROR: Couldn't open configuration file:
    scalpel.conf -- No such file or directory
    Scalpel was unable to read a needed file and will abort.

    what the solution of this….?

  4. Hi there is option to restore any files
    the NONE options should work for any ?

    actually im wonder how to restore py (python) files

  5. Most of them are command mode…testdisk and photorec and not very helpfull. tried backbox but unsuccessfull since they are in command mode and tough to know syntax for same. any other free gui recovery options for formatted or bad hard disks. pls ctct johntarun ate gmail


Leave a Reply to abc Cancel reply

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.