Recover deleted files with Foremost on Linux

Did you ever deleted some important files and panicked on how to recover it? On Linux there is Foremost that can come to the rescue.

Not many users know that deleting a file from a file manager or with ‘rm’ from a terminal is not enough to really remove it from your hard disk; these methods simply remove the “link” that map the hard drive area that is containing the file to the file system record for the file in question, but that hard drive area will continue to contain the file data until the file system decides to reuse the area for a new file.

Foremost can analyze a specific directory or the entire hard drive looking for any deleted files to recover; it also allow to select the file type to search.

You can install the program from your distribution’s package manager or from a terminal, for example in Ubuntu:
sudo apt-get install foremost

Or in Gentoo:
emerge foremost

One installed, open the terminal and type:
sudo foremost -v -t jpg -i /dev/sda1 -O /home/[your-username]/

Obviously the command must be customized to your needs, for example after ‘-t‘ you have to enter the file type you want to search (insert ‘all‘ for a generic search), after ‘-i‘ enter the path of the device to be scanned and after ‘-O‘ enter the path where you want to save the files.

Depending on the amount of files found, the program may take some time to finish; also make sure you have enough space left on the destination partition for all the files you want to recover.