How to Recover Deleted Files in Debian on Debian 12 Bookworm System

Accidentally deleting files can be a frustrating experience, especially on a Linux system like Debian 12 Bookworm where tools like Trash or Recycle Bin may not always catch every deletion. Whether you’ve mistakenly removed a crucial system file, personal document, or project folder, it’s important to know that recovery is still possible—but time is of the essence.

In this article, we’ll explore how to recover deleted files in Debian 12, using a combination of built-in utilities, third-party tools, and best practices to maximize your chances of successful recovery.

Table of Contents

• Table of Contents
• 1. Understanding File Deletion on Linux
• 2. Act Quickly and Minimize Disk Usage
• 3. Check Trash Directory (GUI Users)
• 4. Using extundelete to Recover Files
  • What is extundelete?
  • Install extundelete
  • Unmount the target partition
  • Recover all deleted files
  • Recover a specific file
• 5. Using testdisk and photorec
  • Installing TestDisk
  • Launching TestDisk
  • Using PhotoRec
• 6. Recovering Files with debugfs
  • Install and run debugfs
  • Inside debugfs prompt
• 7. Backup and Preventive Measures
  • Enable Backups
  • Create Snapshots
  • Use File Versioning Tools
  • Use trash-cli for safe deletions
• 8. Conclusion

1. Understanding File Deletion on Linux

When you delete a file on Debian or any Linux distribution using a command like rm, the file is not moved to the trash. Instead, the inode (a reference to where the data is stored on disk) is unlinked from the file system, and the data is marked as free space. However, the actual data remains on the disk until overwritten.

This gives recovery tools a window of opportunity to restore the file. But if you’ve continued using the system, you risk overwriting the deleted file’s data, making recovery much harder—or impossible.

2. Act Quickly and Minimize Disk Usage

Before attempting file recovery:

• Stop using the affected partition: Every write operation can overwrite deleted data.
• Unmount the drive if possible: This is especially important if the deleted file was on an external or secondary drive.
• Avoid installing new packages: Use a live CD/USB environment if necessary.

You can check mounted partitions with:

df -h

If your deleted file was on /home, try unmounting it:

sudo umount /home

Note: Unmounting / (root partition) isn’t feasible while the system is running. In such cases, consider using a live USB to boot into a recovery environment.

3. Check Trash Directory (GUI Users)

If you deleted a file via the GNOME, KDE, or other desktop environments using a file manager like Nautilus or Dolphin, the file might be in the Trash.

Check using the GUI or from the command line:

cd ~/.local/share/Trash/files/
ls

You might find your deleted files here. If so, simply move them back:

mv <filename> ~/Documents/

This method works only if you used the desktop environment to delete the file. The command-line rm does not move files to Trash.

4. Using extundelete to Recover Files

What is extundelete?

extundelete is a powerful tool designed to recover files from ext3 or ext4 partitions. Since Debian 12 uses ext4 by default, this is often the most effective method—but it requires the partition to be unmounted.

Install extundelete

sudo apt update
sudo apt install extundelete

Unmount the target partition

Find the partition your file was on using:

lsblk

Assume it’s /dev/sda3. Unmount it:

sudo umount /dev/sda3

Recover all deleted files

sudo extundelete /dev/sda3 --restore-all

Recovered files will be placed in a folder called RECOVERED_FILES in your current directory.

Recover a specific file

If you know the path (e.g., /home/user/Documents/report.docx), you can run:

sudo extundelete /dev/sda3 --restore-file /home/user/Documents/report.docx

Note: extundelete does not work on mounted partitions. Always use it from a live USB environment or unmount the volume.

5. Using testdisk and photorec

Installing TestDisk

sudo apt install testdisk

Launching TestDisk

sudo testdisk

TestDisk provides a text-based interface to:

• Search for lost partitions.
• Recover deleted files from supported filesystems (FAT, NTFS, ext2).
• Rebuild partition tables.

Navigate with arrow keys and follow prompts to select the affected disk, partition type, and recovery options.

Using PhotoRec

PhotoRec is bundled with TestDisk and is file-type-based:

sudo photorec

• Select the disk.
• Choose partition and file system type (usually ext2/ext3/ext4).
• Choose where to save recovered files (don’t save on the same partition).
• Begin scan.

PhotoRec can recover a wide range of file types (images, documents, archives), but it doesn’t preserve original filenames or directory structure.

6. Recovering Files with debugfs

debugfs is a file system debugger that works with ext-based partitions. It allows low-level access, including viewing recently deleted inodes.

Use only if you’re comfortable with file system internals.

Install and run debugfs

sudo apt install e2fsprogs
sudo debugfs /dev/sda3

Replace /dev/sda3 with your partition.

Inside debugfs prompt

List deleted inodes:

lsdel

You’ll see a list like:

Inode  Owner  Mode    Size  ...
12345  1000   100644  20480 ...

To recover inode 12345:

dump <12345> /home/youruser/recovered_file

Then exit:

quit

Note: debugfs may not work on mounted partitions—prefer to use it from a live USB.

7. Backup and Preventive Measures

While recovering files is sometimes possible, it’s never guaranteed. Prevention is always better. Here are some best practices for future protection:

Enable Backups

• Use Deja Dup for GUI backups (built into GNOME).
• Use rsync or BorgBackup for CLI-based backups.
• Store backups on external drives or cloud services.

Example using rsync:

rsync -a --delete /home/user/ /mnt/backup_drive/user_backup/

Create Snapshots

Use Btrfs snapshots (if your file system supports it) or LVM snapshots for regular rollback points.

Use File Versioning Tools

• git for tracking file changes.
• Tools like Syncthing or Nextcloud with version history features.

Use trash-cli for safe deletions

Install it:

sudo apt install trash-cli

Then instead of rm, use:

trash-put myfile.txt

You can restore files with:

trash-restore

8. Conclusion

Recovering deleted files in Debian 12 Bookworm is entirely possible—especially if you act quickly and choose the right tools. Whether you’re a desktop user who relies on Trash, or a command-line enthusiast who needs to unearth lost data from ext4 partitions, Debian provides robust options.

Here’s a quick recap of tools and when to use them:

Always remember: the moment you realize a file has been deleted, minimize system activity, and if possible, boot into a live environment before attempting recovery. And don’t forget to set up regular backups moving forward.

Have you ever recovered files on Debian? What tools worked best for you? Let us know in the comments below!