How to Recover Deleted Files on Arch Linux

Accidentally deleting important files on a Linux system can be a heart-sinking moment. Fortunately, all hope is not lost. Whether you’ve deleted files via the command line using rm or through a file manager, there are methods to recover them—though success is never guaranteed.

On Arch Linux, recovering deleted files is possible with the right tools, knowledge of how the Linux filesystem works, and a bit of care to avoid overwriting the data you’re trying to recover.

This guide will walk you through various methods to recover deleted files on Arch Linux, including both manual approaches and using specialized recovery tools.

1. Understanding How Deletion Works on Linux

When you delete a file using rm, it’s not moved to a recycle bin or trash—it’s removed from the filesystem directory structure. However, the data blocks on disk are not immediately overwritten; they are simply marked as “free space.” This makes it theoretically possible to recover the file—if you act quickly.

File recovery success depends on:

• The file system type (ext4, btrfs, xfs, etc.)
• How much time has passed since deletion
• Disk activity after deletion
• Whether journaling was involved

If you’re using a journaling filesystem like ext4, metadata is recorded that can sometimes be used to help recover files. Btrfs users might rely on snapshotting, and XFS users can use tools like xfs_undelete.

2. Pre-Recovery Precautions

Once you realize you’ve deleted a file:

✅ Stop Using the Affected Partition

Avoid writing to the same partition where the file was deleted. Continued usage may overwrite the deleted file’s data blocks.

✅ Unmount the Partition (if possible)

If the deleted file resides on a non-root partition:

sudo umount /dev/sdXn

If it’s on the root (/) partition, you might want to shut down the system and boot into a live Arch Linux environment using a USB drive to avoid any write operations.

✅ Mount the Filesystem as Read-Only

From a live session:

sudo mount -o ro /dev/sdXn /mnt/recovery

3. Recovering from Trash (GUI Users)

If you deleted the file through a file manager like Nautilus, Dolphin, or Thunar, it may be in the Trash. Open your file manager and look in:

~/.local/share/Trash/files/

You can simply move the files back if they’re there.

Command line alternative:

ls ~/.local/share/Trash/files/
mv ~/.local/share/Trash/files/filename ~/Documents/

However, if you used rm or a command-line tool, this won’t help—continue to the next sections.

4. Recovering Recently Deleted Files with extundelete

If your filesystem is ext3 or ext4 and it’s unmounted, extundelete is a great tool.

🔧 Install extundelete

sudo pacman -S extundelete

🧪 Usage

Assume /dev/sdX1 is your affected partition.

1. Unmount the partition if it’s still mounted:

   sudo umount /dev/sdX1
   

2. Run extundelete:

   sudo extundelete /dev/sdX1 --restore-all
   

3. Recovered files will be placed in a directory named RECOVERED_FILES.

Note: extundelete does not work on mounted or journal-less ext4 partitions.

5. Using testdisk and photorec

Both tools are powerful for file and partition recovery, though photorec works on file headers rather than filenames or metadata.

🔧 Install Them

sudo pacman -S testdisk

🔍 Using testdisk for Deleted File Recovery

1. Run testdisk as root:

   sudo testdisk
   

2. Choose your disk.

3. Select the partition table type (usually Intel for BIOS or EFI GPT for UEFI).

4. Choose [Advanced] Filesystem Utils.

5. Select your partition and choose Undelete.

6. Browse through deleted files. Use c to copy selected files to a safe directory (e.g., external drive).

📂 Using photorec for Data Carving

photorec ignores the filesystem and searches for file headers.

1. Run:

   sudo photorec
   

2. Select the disk and partition.

3. Choose the file types to recover.

4. Set output directory (use a different partition or USB drive).

5. Let it scan—it may recover many files, but filenames and folder structures may be lost.

6. Using debugfs on ext2/ext3/ext4

A low-level tool for interacting with ext filesystems.

🔧 Install e2fsprogs (usually pre-installed)

sudo pacman -S e2fsprogs

⚙️ Using debugfs

1. Unmount the partition:

   sudo umount /dev/sdXn
   

2. Open with debugfs:

   sudo debugfs /dev/sdXn
   

3. Run:

   lsdel
   

   This lists deleted inodes.

4. Recover a file by inode:

   dump <inode> recovered-file
   

5. Exit:

   quit
   

Caution: debugfs is powerful and low-level—used improperly, it can damage the filesystem.

7. Recovering Files on Btrfs with Snapshots

If you use Btrfs and have snapshots (via tools like snapper or btrbk), recovery is simple.

📁 Browse Snapshots

If your snapshots are stored in .snapshots:

cd /.snapshots

Find the appropriate snapshot, and copy the file back:

cp /.snapshots/101/snapshot/home/user/important.txt ~/Documents/

🧰 If You Don’t Use Snapshots

If no snapshots exist, Btrfs has limited file recovery. Tools like btrfs restore may help:

sudo btrfs restore -i /dev/sdXn /mnt/recovery

This attempts to copy files from a damaged or mounted partition.

8. Preventive Measures

To avoid future mishaps, consider the following practices:

🔁 Enable Trash for Command Line

Use trash-cli:

sudo pacman -S trash-cli

Instead of rm, use:

trash-put filename

🧯 Enable Backups and Snapshots

• Use Btrfs with snapper or timeshift.
• Use rsync for periodic backups.
• Store important files in cloud services or external drives.

🛡️ Filesystem-specific Tools

• ext4: extundelete, debugfs
• btrfs: snapper, btrfs restore
• xfs: xfs_undelete (external tool)

9. Conclusion

Recovering deleted files on Arch Linux is a delicate process that depends heavily on your filesystem, how the file was deleted, and what actions you take immediately afterward. While Linux offers powerful tools like extundelete, testdisk, photorec, and debugfs, none guarantee success.

Your best defense is preparation: use backups, snapshots, and tools that make file deletion reversible. If you’re reading this before a disaster—start implementing those safeguards now.

But if you’re dealing with an accidental deletion today, take a breath, avoid using the system, and follow the steps above methodically. With some luck, you’ll be able to retrieve your lost data and walk away wiser for next time.