Top 18 Best Linux Data Recovery Tools

Data loss on Linux happens fast. An accidental rm, a corrupted partition table, a drive that starts clicking. The question is not whether recovery is possible, but which tool to pick.

Almost all Linux data loss falls into five scenarios. Find your situation in the table below, then jump to the section with the right tool, the install command, and the basic usage to get your data back.

When you need a Linux data recovery tool

Data loss on Linux falls into a handful of scenarios. Each scenario maps to a category of recovery tool. Use the table below to find your situation, then jump to the section that fits.

The tools below are free and open source. A few have paid tiers for GUI versions or commercial use. The command-line versions work on any Linux distribution.

What you need before you start

Stop using the drive immediately. Every write operation risks overwriting the data you want to recover. If the data is on your boot drive, shut down the machine and boot from a USB stick with a live Linux distribution.

Identify the drive you need to work on. Run lsblk to see all block devices and their mount points. The drive you want to recover from should not be mounted, or mounted read-only.

You will need a second drive or USB stick to store recovered files. Never recover data back onto the same drive you are recovering from.

Recover deleted files with file carving

File carving tools scan the raw disk blocks for file signatures. They do not care about the filesystem metadata.

When a file is deleted, the directory entry is removed but the actual data blocks stay on disk until overwritten. Carving tools find those blocks by looking for known file headers and footers, and they work even when the filesystem itself is damaged beyond repair.

1. PhotoRec

PhotoRec ignores the filesystem and goes straight to the raw data. It recognizes hundreds of file formats by their headers and footers. The companion tool to TestDisk, it stores recovered files in a directory you specify, organized by file type.

sudo photorec /dev/sdX

Replace /dev/sdX with your actual drive. PhotoRec runs interactively. Select the partition type, then choose the filesystem type, then pick a destination directory for recovered files.

2. Foremost

Foremost was built for law enforcement but works for anyone. It carves files based on headers and footers defined in a configuration file. The default config covers common formats like jpg, png, pdf, doc, and zip.

sudo foremost -t jpg,pdf,doc -i /dev/sdX -o /recovery/output

The -t flag limits recovery to specific file types. Without it, Foremost tries every type in its config, which takes longer but catches more.

3. Scalpel

Scalpel is a faster rewrite of Foremost. It uses asynchronous I/O and a header/footer database to carve files more efficiently. The configuration file defines which file types to look for.

sudo scalpel /dev/sdX -o /recovery/output

4. The Sleuth Kit

The Sleuth Kit gives you filesystem-level analysis. The fls tool lists all files including deleted ones, and icat extracts the content of any inode.

This approach works when the filesystem metadata is partially intact.

sudo fls -r -d /dev/sdX | grep deleted
sudo icat /dev/sdX 12345 > recovered_file.jpg

Fix partition tables and boot sectors

When a drive shows as unformatted or the wrong size, the partition table is usually damaged. The data is still on disk. These tools rebuild the partition table or fix the boot sector so the system can access the partitions again.

5. TestDisk

TestDisk scans the drive for partition signatures and rebuilds the partition table. It works with GPT, MBR, and many filesystem types. The interactive interface walks you through the recovery steps.

sudo testdisk /dev/sdX

Choose the partition table type, select the drive, then pick Analyse. TestDisk scans for lost partitions and lets you write a new partition table when it finds them.

6. Boot Repair

Boot Repair fixes GRUB and boot sector issues. When Linux won’t boot after a Windows update or a disk change, this tool reinstalls GRUB and restores the boot menu.

sudo add-apt-repository ppa:yannubuntu/boot-repair
sudo apt update
sudo apt install boot-repair
sudo boot-repair

7. GParted Live

GParted Live is a bootable Linux distribution focused on partition management. It can create, resize, move, and recover partitions. The GUI helps you visualize the disk layout before making changes.

8. Redo-Backup and Recovery

Redo Backup boots from USB or CD and gives you a full desktop environment with recovery tools. It includes TestDisk, PhotoRec, and GParted in one place. Good for machines where you cannot install tools on the running system.

Rescue data from a failing drive

When a drive has physical problems, every read attempt risks making it worse. The strategy is to image the drive first, then work on the copy. These tools handle read errors gracefully and can resume interrupted imaging.

9. Ddrescue

GNU ddrescue copies a drive to an image file, skipping bad sectors and coming back to them later. It uses a log file to track progress and can resume interrupted copies. This is the first tool to reach for when a drive is failing.

sudo ddrescue /dev/sdX /recovery/disk.img /recovery/rescue.log

The log file lets ddrescue retry bad sectors without re-reading the good parts. Run it multiple times and it will make progress on each pass.

10. SafeCopy

SafeCopy is similar to ddrescue but with a simpler interface. It recovers as much data as possible from damaged drives and can remember recovery positions across disconnections. Useful for USB drives that drop connection.

sudo safecopy /dev/sdX /recovery/disk.img

Recover from ext3/ext4 filesystems

Linux ext3 and ext4 filesystems keep a journal of recent operations, and when the filesystem is damaged, these tools use the journal or scan the inode table to find and recover deleted files.

11. Extundelete

Extundelete recovers deleted files from ext3 and ext4 filesystems by looking at the journal, restoring file names on ext4 and recovering full file content as long as the blocks have not been reused. Recovered files land in a RECOVERED_FILES directory in your current working directory, so run this immediately after deletion for the best chance of recovery.

sudo extundelete /dev/sdX --restore-all

12. Ext3undel

Ext3undel combines multiple recovery approaches for ext3 filesystems, using the directory inode, the journal, and file carving together to recover more files than any single method alone. For direct filesystem repair, e2fsck handles ext2, ext3, and ext4, fixing the journal, rebuilding the superblock, and recovering orphaned files when corruption prevents mounting.

13. e2fsck

sudo e2fsck -y /dev/sdX

The -y flag answers yes to all prompts. Use it when you know the filesystem is damaged and want e2fsck to fix everything it can.

GUI recovery tools for desktop users

If you prefer a graphical interface, these tools provide point-and-click recovery. They wrap the same command-line engines but add progress bars, previews, and simpler workflows.

14. R-Undelete

R-Undelete uses IntelligentScan to find deleted files on FAT, ext, and NTFS filesystems. The free version works for personal use. The paid version adds support for more filesystem types and RAID recovery.

15. Disk Drill for Linux

Disk Drill offers a free tier that recovers up to 500 MB of data. It scans for deleted files and can create a disk image for safe recovery. The interface shows previews of recoverable files before you commit to recovery.

16. System Rescue CD

System Rescue CD is a bootable Linux distribution packed with recovery tools. It includes TestDisk, PhotoRec, ddrescue, and FSArchiver. Boot from USB and you have a full recovery environment without touching the installed system.

17. Knoppix

Knoppix is a Debian-based live CD that runs entirely from USB or CD. It includes recovery tools alongside a full desktop environment. Good for recovering data from a machine where the installed OS will not boot.

18. Trinity Rescue Kit

Trinity Rescue Kit is a free Linux distribution focused on recovery and virus scanning. It can reset passwords, scan for viruses, and recover files from both Linux and Windows filesystems.

Verify your recovery and protect against next time

After recovery, verify the files are intact. Open a sample of recovered images, documents, and archives to confirm they are not corrupted. Check file sizes against what you expect.

Set up a backup strategy so you do not need recovery tools again. The 3-2-1 rule works: three copies of your data, on two different media, with one copy offsite. Tools like rsync, borgbackup, or restic automate this on Linux.

For drives that are still failing, do not keep using them. Replace the drive and restore from your new backup. Recovery tools are a last resort, not a storage strategy.

Frequently Asked Questions

The questions below come from user forums and search queries. Each answer gets you to the right tool or command.

What tool is the right choice for Linux data retrieval?

TestDisk and PhotoRec cover the broadest range of scenarios. TestDisk fixes partition tables and recovers deleted partitions, while PhotoRec carves files from raw disk blocks.

Together they handle the majority of data loss cases on Linux.

What is the best approach for data recovery?

Stop using the drive immediately. Boot from a live USB. Identify the drive with lsblk, and pick the tool that matches your scenario from the table above.

Recover to a different drive, never back onto the one you are recovering from.

Which tools do people reach for first?

TestDisk, PhotoRec, ddrescue, and Foremost are widely used. They are free, open source, and available on many Linux distributions. Commercial tools like R-Studio and Disk Drill are also popular for their GUI interfaces.

Is Ddrescue safe to use?

Yes. Ddrescue only reads from the source drive and never writes to it. The imaging process is read-only and safe to run on failing drives.

In Linux, how can I restore files?

Run testdisk /dev/sdX and choose your partition table type. Select Advanced, then Undelete to browse deleted files. Copy them to another drive.

What is the one element of data recovery you cannot skip?

Stop using the drive. Every moment the system runs, there is a chance the deleted data gets overwritten. Shut down and boot from a live USB for the best chance of recovery.