How to recover the Permanently (shift+delete )Deleted file in Ubuntu
Restore the Deleted Files
Sometimes we delete the files permanently, and realize its importance to restore it.
Here is the solution
Foremost
Foremost is a free software to recover files1.) Install foremost
sudo aptitude install foremost
Foremost examples
Search for jpeg format skipping the first 100 blocks
sudo foremost -s 100 -t jpg -i image.dd
Search for gif and pdf
sudo foremost -t gif,pdf -i image.dd
Search for office documents and jpeg files in a Unix file sys-tem in verbose mode.
sudo foremost -v -t ole,jpeg -i image.dd
scalpel
Scalpel to recover the Deleted file.
A Frugal, High Performance File CarverA fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions. It is useful for both digital forensics investigation and file recovery.
1.) Install scalpel in Ubuntu
sudo aptitude install scalpel
2.) open the scalpel.conf file in gedit using the below command
gedit /etc/scalpel/scalpel.conf
3.) Uncomment all the Lines by deleting the ' # '
4.) sudo scalpel "FILE" -o "Directory "
Where FILE is the image file (or device) and Directory is the output directory.







