What happens when you delete a file on Linux

When you delete a file on Linux, the file itself usually stays on your hard drive — the operating system just removes the pointer that tells it where the file is. Think of it like erasing a library card catalog entry without actually burning the book. Until your system writes new data over that space, the file's contents remain recoverable.

The catch is timing. The longer you wait, the more likely your system has overwritten that space with new files, photos, or updates. If you deleted something five minutes ago, recovery is usually straightforward. If you deleted it three weeks ago and have been using your computer normally, recovery becomes much harder or impossible.

This is why the first step after realizing you deleted something important is to stop using your computer. Every file you open, every download, every system update writes new data to your drive and makes recovery less likely.

Key Takeaways

  • Stop using your computer immediately after deleting a file — every new file written to disk makes recovery harder.
  • Tools like testdisk, photorec, and extundelete can scan your drive for deleted file data, but they work best within hours of deletion.
  • Recovery works differently depending on your file system — ext4 is more recoverable than btrfs or newer systems with automatic snapshots.
  • Files deleted from a USB drive or SD card are often easier to recover than files deleted from your main hard drive.
  • If you emptied your trash and overwrote the space, professional recovery services exist but cost hundreds of dollars and work only on mechanical drives.

Using testdisk and photorec for file recovery

Testdisk and photorec are free tools that scan your drive for deleted files. Testdisk finds lost partitions; photorec finds individual files. Both come in the same package and work on Linux, Windows, and Mac.

To use them, you need to boot from a live USB or CD — you cannot recover files from the drive you are currently running Linux on, because the act of running the system writes data to that drive. Download a live Linux distribution like Ubuntu or Linux Mint, write it to a USB drive using Balena Etcher or dd, and boot from that USB instead of your normal drive.

Once booted into the live system, open a terminal and install photorec: sudo apt install testdisk (on Ubuntu/Debian) or the equivalent for your distribution. Run sudo photorec and point it at the drive or partition where you deleted the file. Photorec will scan the drive, find file signatures (the data patterns that mark the start of a photo, document, or video), and recover what it finds to a folder you specify on an external drive.

The process takes time — scanning a 500 GB drive can take several hours. Photorec will recover files with generic names like f1234567.jpg because it cannot read the original file names from deleted data. You will need to sort through the results to find what you actually want.

Using extundelete for ext4 file systems

Extundelete is more targeted than photorec. It works specifically on ext4 file systems (the default on most Linux distributions) and can sometimes recover the original file names and directory structure. It is faster than photorec for this reason, though it only works if the file system journal still contains information about the deleted file.

Install extundelete with sudo apt install extundelete, then run it from a live USB the same way you would photorec. The command sudo extundelete --restore-all /dev/sdX (replace sdX with your actual drive) will scan and recover files to a RECOVERED_FILES folder.

Extundelete works best within the first few hours after deletion, before the file system journal is overwritten. If you deleted a file weeks ago, extundelete is unlikely to find it, and photorec becomes your better option.

Why recovery fails and what to do instead

Recovery fails most often because the space was overwritten. If you deleted a file, then downloaded a large video, installed an update, or copied photos from your phone, the new data has likely written over the deleted file's location. Once that happens, no tool can recover it.

Recovery also fails if your system uses btrfs, ZFS, or other modern file systems with built-in snapshots. These systems often keep automatic backups of your files, but they do not work like traditional recovery tools — you access them through your file manager or a snapshots folder, not through photorec. Check your system settings or ask your distribution's documentation whether snapshots are enabled.

If recovery tools find nothing and you do not have backups, your options narrow. Professional data recovery services can sometimes recover data from mechanical hard drives by replacing failed components or reading the drive at a hardware level. These services cost $300 to $3,000 depending on the damage and the amount of data. They do not work on SSDs, which overwrite data more aggressively and do not retain recoverable traces the way mechanical drives do.

Recovering files from USB drives and SD cards

USB drives and SD cards are often easier to recover from than your main hard drive, because they are used less frequently and the deleted data is less likely to be overwritten. The same tools work — photorec and testdisk — but you can usually run them directly from your main system without needing a live USB.

Plug in the USB drive or SD card, open a terminal, and run lsblk to see what device name it has (usually something like /dev/sdb). Then run sudo photorec /dev/sdb and point the output to an external drive. Because USB and SD cards are slower than internal drives, the scan will take longer, but the recovery rate is usually higher.

One important note: if you formatted the USB drive or SD card after deleting the file, recovery becomes much harder. Formatting writes a new file system to the drive, which can overwrite the deleted file's data. If you have not formatted it, your chances are good.

Preventing this from happening again

The most reliable solution is a backup system that runs automatically. Tools like rsync, Timeshift, or Bacula can back up your files to an external drive or network storage on a schedule. Timeshift is the easiest for most users — it creates snapshots of your entire system that you can restore from if something goes wrong.

Set up a backup to run daily or weekly, and keep the external drive disconnected from your computer most of the time. This protects you not just from accidental deletion, but from ransomware, hardware failure, and other data loss scenarios that recovery tools cannot fix.

For important files, consider using a version control system like git if you are comfortable with the command line. Git keeps a history of every change you make to a file, so you can recover an older version even if you deleted the current one.

Frequently Asked Questions

Can I recover a file I deleted weeks ago?

Possibly, but it depends on how much you have used your computer since. If you deleted it weeks ago but have not downloaded large files, installed updates, or copied photos, the data might still be there. Photorec will find it if it is. If you have been using your computer normally, the space has almost certainly been overwritten and recovery is not possible.

Do I need to physically remove my hard drive to recover files?

Not for photorec or extundelete. You need to boot from a live USB so you are not running your normal operating system, but the drive can stay in your computer. If you are uncomfortable with that, you can remove the drive and connect it to another computer via a USB adapter, then run the recovery tools from there.

What if the recovery tool finds thousands of files and I do not know which one is mine?

Photorec recovers files by type — it groups photos, documents, videos, and so on into separate folders. Start by looking in the folder that matches your file type. If you remember roughly when you deleted it or what it contained, you can sort by file size or date to narrow it down. This is why recovery is easier if you act quickly — fewer files will have been written to the drive since deletion.

Will recovery work on an SSD?

Recovery on SSDs is much less reliable than on mechanical drives. SSDs use wear-leveling technology that automatically overwrites deleted data more aggressively. Photorec and extundelete might still find something, but do not expect the same success rate as with a traditional hard drive. Professional recovery services generally cannot recover data from SSDs.

Can I recover files if I used secure delete or shred?

No. Tools like shred and secure-delete overwrite the file data multiple times before deletion, making recovery impossible. If you used one of these tools intentionally, the file is gone. If you used it by accident, there is no recovery option.