one of my friend accidently deleted all files (jpg and pdf) from file server by using rm -rf command .is there is a way to recover those files with actual file names?

key points -

  1. there is no backups for restore
  2. partition format is ext4

we tried following solutions.

  1. testdisk - recovered few files only (with actual file name)
  2. photorec - recovered lots of files with useless .txt files (without actual file names)
  3. foremost - recovered pdfs and jpgs without file names
  • 4
    nope, your files are gone. but look on the bright side: your friend gifted you a valuable lesson in why backups are essential.
    – cas
    Jul 14 at 14:22
  • strange that photorec didn't work, did you use a lot your system before trying recovery? Jul 14 at 14:30
  • I long struggled with doing backups too. I am now recommending doing all files snapshots with timeshift, it's lightning-fast, easy to set up, and easy to restore any file of any timeline. As @cas said, your files are mostly gone, without some really time-consuming effort, I do feel much more confident between changes on my system, simply because I learned a hard lesson, and after I calmed down a bit from personal files gone, I was very grateful in the end. Best of luck. Jul 15 at 14:42
  • @LinuxSecurityFreak I use ZFS snapshots (or rsync to a ZFS server to backup filesystems that aren't ZFS, and then snapshot)....and then use zfs send to send the snapshots to my backup server. This timeshift looks interesting, looks like it can do either btrfs snapshots or use rsync, depending on what filesystem it is. nice.
    – cas
    Jul 15 at 14:47
  • As a note: Dump the journal as fast as possible debugfs -R "dump <8> dump.journal" /dev/deviceN (do not dump to the affected partition). Unmount the partition. If you need the partition up and running, create a full copy of it, then remount. After that work on recovery.
    – ibuprofen
    Jul 16 at 8:03

If you recovered some valid jpg and pdf files without filenames, you might be able to identify them to some extent.

For PDFs that contain text (not just scans), you can get back some of the text with:

$ pdftotext /home/paul/Downloads/Canalside/CAR*.pdf - > SomePDF.txt
$ wc SomePDF.txt
  85  406 2535 SomePDF.txt
$ head -n 4 SomePDF.txt
Wiltshire Council
Authority Address
Contact Name

If they have some consistent format, you could parse the text for titles or page footers. You might even find an OCR option for scanned images.

For .jpg files, the file command outputs a datetime value, which is at least a unique name, and gives you a sequence and a possible identity (maybe you keep a calendar or time-sheets to correlate against).

$ file /media/paul/Windows/30_Photos/PhotoStore/A810_Folders/119_1402/IMG_1280.JPG
/media/paul/Windows/30_Photos/PhotoStore/A810_Folders/119_1402/IMG_1280.JPG: JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=10, description=                               , manufacturer=Canon, model=Canon PowerShot A810, orientation=upper-left, xresolution=194, yresolution=202, resolutionunit=2, datetime=2013:02:14 10:49:18], baseline, precision 8, 4608x3456, frames 3
  • Thanks for the your reply. can you please tell me how the file command is use for .jpg files?
    – KMS
    Jul 15 at 7:57
  • Thank you very much.
    – KMS
    Jul 15 at 8:38
  • i tried the file command, but i got following result, "/Recovery_disk/recovery_by_kasun_1/jpg/999985297.jpg: JPEG image data, JFIF standard 1.01"..........why is this happen?
    – KMS
    Jul 15 at 10:08
  • @KMS Because that is what the file command is for. It tells you everything it can about the file, using the metadata from the .jpg definition. The purpose is that the metadata is probably more useful to you than the label 999985297 that it generated. How you use the metadata to identify the file is up to you. Jul 15 at 17:21
  • 1
    In addition to file, pdfinfo from the poppler-utils package is also useful. As is exif or exiftool. And mediainfo too. These can display the embedded metadata in various kinds of files, if there is any there to show (some can be used to edit the metadata too).
    – cas
    Jul 17 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.