Which Linux data recovery tool you need depends entirely on what actually happened: a deleted file, a wiped partition, a failing drive, or a filesystem that won’t mount. There’s no single “best” tool because these are different problems — TestDisk fixes a partition table, PhotoRec carves files back out of raw disk sectors, ddrescue clones a dying drive before it gets worse. This guide covers six real, still-maintained tools, what each one is actually for, and the one step that matters more than any tool you pick.
First: Stop Writing to the Drive
Before touching any tool, understand what kind of loss you’re dealing with. Data loss is either logical — a corrupted partition table, a deleted file, filesystem damage — which is “not a problem in the hardware and requires software-level solutions,” or physical — a head crash, failed motor, or damaged platters — which generally “cannot be repaired by end users” and needs a professional cleanroom recovery service [1]. Nearly everything in this guide addresses logical loss.
Either way, the same rule applies first: stop using the affected drive. “The longer a faulty drive is used, the more likely further data loss is to occur” [1] — every write risks overwriting the exact data you’re trying to recover. If you can, image the drive to a second disk with dd or ddrescue and run your recovery attempts against the copy, not the original.
The Tools, Side by Side
| Tool | Fixes | Filesystems | License |
|---|---|---|---|
| TestDisk | Lost/deleted partitions, non-bootable disks [2] | FAT, exFAT, NTFS, ext2/3/4, btrfs, XFS, HFS+, APFS, and more [2] | Free, open source (GPLv2+) |
| PhotoRec | Individual deleted/lost files, even with the filesystem gone [3] | Filesystem-agnostic — recovers by file signature, not directory structure [3] | Free, open source (GPLv2+) |
| extundelete | Recently deleted files on ext3/ext4, using journal entries [6] | ext3, ext4 only [6] | Free, open source |
| ddrescue | Copying data off a failing/damaged drive without losing more [4] | Any — works at the block level, not filesystem-aware | Free, open source (GNU) |
| R-Linux | File recovery from reformatted/damaged ext partitions [7] | ext2, ext3, ext4 only [7] | Free (paid R-Studio adds RAID/network recovery) |
TestDisk — Fix the Partition Table First
TestDisk, maintained by CGSecurity, specializes in recovering lost partitions and making non-bootable disks bootable again — repairing partition tables, rebuilding FAT/NTFS boot sectors, and undeleting files on FAT, exFAT, NTFS, and ext2 [2]. If your drive shows as unallocated space or the OS won’t boot but the data should physically still be there, TestDisk is the first tool to reach for, not PhotoRec — it works with the filesystem structure instead of ignoring it.
PhotoRec — When the Filesystem Itself Is Gone
PhotoRec is TestDisk’s companion tool, built for a harder case: the filesystem structure is too damaged to trust, or already gone. Instead of reading directory entries, it scans the disk block by block, comparing each block against a database of over 480 file-type signatures across roughly 300 file families, and extracts each match until it hits the next file’s signature [3]. That means it can recover files even with zero usable filesystem metadata — the tradeoff is it recovers anonymous files (no original names or folder structure), and it has a documented limitation with ReiserFS specifically, since that filesystem stores file data differently inside its tree structure [3].
extundelete — Fast Recovery Using the ext3/ext4 Journal
extundelete is narrower by design: ext3/ext4 only, but fast, because it reads the filesystem’s own journal to find a recently-deleted file’s old inode, matches it to a filename from leftover directory entries, and pulls the data straight out [6]. It starts producing results within a minute or two of parsing the journal, rather than scanning the whole disk [6] — but it depends on the deleted file still having journal entries, so it’s a “did I just delete this” tool, not a long-after-the-fact one. Critically, the target partition must be unmounted first; running it against a mounted or busy drive risks corrupting the disk further.
ddrescue — When the Drive Itself Is Failing
ddrescue solves a different problem entirely: a physically failing drive where a normal copy stops dead at the first bad sector. It reads the easy, accessible sectors first and comes back for the damaged regions afterward, rather than giving up [4]. Its mapfile tracks exactly which sectors succeeded, so a recovery attempt can be safely interrupted and resumed without re-reading data already saved — and running it again later, or against a second failing copy of the same source, can fill in gaps that failed the first time [4]. Use ddrescue to clone a dying drive to a healthy one first, then run TestDisk/PhotoRec/extundelete against the clone — not the original.
R-Linux — A Free GUI Option for ext Partitions
R-Linux is R-Tools Technology’s free utility for ext2/ext3/ext4 recovery, using the same scanning technology as their paid R-Studio product, and runs on both Linux (kernel 2.6+) and Windows [7] — useful if you’ve pulled a Linux-formatted drive and want to recover from a Windows machine instead. The free version’s limits: no network recovery, no RAID reconstruction, and no object-copy support, all of which require upgrading to full R-Studio [7].
Which Tool Do You Actually Need?
Recovering Data on a Rented VPS
All of this changes slightly when the disk isn’t physically in front of you. On a rented Linux VPS, you generally can’t run ddrescue against failing hardware yourself — that’s the host’s job, and it’s exactly why a provider’s snapshot and backup policy matters more than any single tool on this list. Before you need any of these tools, know what your VPS hosting plan actually backs up and how often. For logical loss (a bad rm, a botched config), TestDisk/PhotoRec/extundelete work fine over SSH on a Linux VPS exactly as they would locally — just unmount or stop writing to the affected volume the moment you notice, the same rule as on a physical machine.
Frequently Asked Questions
Can I recover a file I deleted and already emptied from a Linux system?
Often yes, as long as you haven’t written new data to that disk since. Linux “deletion” typically just removes the directory entry — the underlying data blocks stay until something overwrites them, which is what extundelete and PhotoRec both exploit.
Do I need TestDisk or PhotoRec?
TestDisk if the partition itself is damaged, missing, or won’t boot. PhotoRec if you need specific files back and the filesystem structure can’t be trusted or is already gone — they’re companion tools built by the same project for these two different problems [2][3].
Why shouldn’t I just keep using the drive while I figure out recovery?
Every write is a chance to overwrite the exact data you’re trying to get back, and continued use of a failing drive increases the odds of further physical damage [1]. Stop, image the drive if you can, and recover from the image.
Are these tools free?
TestDisk, PhotoRec, extundelete, and ddrescue are all free and open source. R-Linux is free with some limitations (no network recovery, no RAID reconstruction) — its paid sibling R-Studio adds those [7].
Conclusion
Match the tool to the actual failure, not the other way around: TestDisk for a damaged partition table, PhotoRec when the filesystem is gone entirely, extundelete for a fast ext3/ext4 journal-based recovery, ddrescue when the hardware itself is failing, and R-Linux when you need to do the work from Windows. The one step that matters more than the tool choice is the first one — stop writing to the affected drive the moment you notice something’s wrong.
References
- Wikipedia — “Data recovery” — en.wikipedia.org
- CGSecurity — “TestDisk” (official) — cgsecurity.org
- CGSecurity — “PhotoRec” (official) — cgsecurity.org
- GNU Project — “ddrescue” (official) — gnu.org
- Wikipedia — “Ext4” — en.wikipedia.org
- extundelete — official project page — extundelete.sourceforge.net
- R-Studio — “Free Linux Recovery (R-Linux)” (official) — r-studio.com