Best tool to recover removed files

Testdisk works great. You could boot from a LiveCD, point testdisk at your drive, navigate to where the deleted files were, and copy them off.


Give a chance to Foremost (here sourceforge project, last v1.5.7 from 2010). It's an easy-to-use forensics program which may be helpful for your case:

sudo apt-get install foremost

Alternative: In this download link you will get a compressed file, inside of which you can find the README file with instructions.

After compiling and installing a description of the command line arguments can be found in the man page:

man foremost

I've uploaded a howto video of Foremost to Youtube:

http://www.youtube.com/watch?v=P767rumEIKw

Please enter in terminal:

cat /proc/partitions

Then you can see which partition you need to use with foremost.

Your command will be:

sudo foremost -a -t FILE-TYPE -i /dev/sdb1 -o /home/map/to/recover/files

You should replace sdb1 to your partition.

Keep me informed.