Can PhotoRec recover files from an SSD?

It can try, but SSDs with TRIM enabled often have the freed blocks zeroed out almost immediately after deletion, leaving nothing for PhotoRec to find. Recovery success on SSDs is much lower than on HDDs.

Will PhotoRec recover the original filenames?

No. Filenames are stored in directory entries, which are erased on deletion. PhotoRec can only recover file content and assign the correct extension based on the file signature it detects.

Do I need to stop using the computer immediately after deleting a file?

Yes, as quickly as possible. Every write to the disk — including swap, logs, and browser cache — can overwrite the blocks that hold your deleted data. Unmount or power down if recovery is critical.

What is the difference between the Free and Whole scan options?

Free scans only sectors marked as unallocated by the filesystem, which is faster and produces less noise. Whole scans every sector, which is necessary after a format or when the filesystem is damaged.

Is TestDisk different from PhotoRec?

Yes. TestDisk focuses on repairing partition tables and recovering lost partitions. PhotoRec focuses on recovering individual files by scanning for file signatures. Both ship in the same package and complement each other.

How to Recover Deleted Files on Linux with PhotoRec

Deleting files by accident happens to everyone. On Linux, once a file is removed from an ext4, XFS, or similar filesystem, the directory entry is gone immediately — but the actual data blocks often remain on disk until they are overwritten. PhotoRec exploits this window. Despite the name, it recovers far more than photos: documents, archives, audio, video, and dozens of other formats are all fair game. It works by scanning raw disk sectors for known file signatures, bypassing the filesystem entirely, which means it even works on formatted or partially corrupted partitions.

PhotoRec ships alongside TestDisk in the same package and is completely free, open-source, and runs in a terminal UI that works over SSH. The critical rule: never write recovered data back to the same device you are recovering from. Always use a second disk or partition.

Install TestDisk / PhotoRec

PhotoRec is part of the testdisk package on all major distributions.

Debian / Ubuntu

sudo apt update && sudo apt install testdisk

Fedora / RHEL 9 / Rocky Linux

sudo dnf install testdisk

Arch Linux

sudo pacman -S testdisk

Verify the install and check the version:

photorec --version

Identify the Right Device

Before launching PhotoRec, confirm which block device holds the data you need. Targeting the wrong device wastes time and risks overwriting evidence.

lsblk -o NAME,SIZE,FSTYPE,MOUNTPOINT,LABEL

Output will vary but look for the disk (sda, nvme0n1, etc.) and the specific partition (sda2, nvme0n1p3). Write down the full device path, for example /dev/sda2.

If the partition is currently mounted, unmount it first. PhotoRec can scan a live mounted filesystem, but an unmounted partition dramatically reduces the risk of new writes overwriting the data you want back:

sudo umount /dev/sda2

If the system refuses to unmount because the partition is in use (e.g., it is your root filesystem), boot from a live USB instead and run PhotoRec from there. This is the safest path for recovering from a system partition.

Prepare a Recovery Destination

Mount or confirm you have a separate writable location with enough free space. A rough rule: allocate at least as much space as the source partition. An external USB drive or a second internal disk both work.

df -h /mnt/recovery

If the destination directory does not exist yet:

sudo mkdir -p /mnt/recovery

Run PhotoRec

Launch PhotoRec as root, pointing it directly at the device or partition:

sudo photorec /dev/sda2

If you are unsure which partition and want PhotoRec to show you the partition table, pass the whole disk:

sudo photorec /dev/sda

Navigating the Terminal UI

Arrow keys move between options; Enter selects.
At the partition list, select the target partition and choose Search.
Choose the filesystem type. For most Linux partitions, select ext2/ext3/ext4. For unknown or Windows disks, choose Other to scan free sectors only, or whole to scan everything.
When asked Free / Whole: choose Free to limit scanning to unallocated space (faster, less noise) or Whole to scan every sector including live files (slower but more thorough after a format).
Navigate to your recovery destination directory and press C to confirm and start the scan.

Limiting File Types with FileOpts

By default PhotoRec searches for every file type it knows (200+). This produces enormous output. Before hitting Search, choose File Opt from the main menu to disable formats you do not need. For example, if you only want documents and archives, disable image and video signatures. Use s to toggle all off, then manually enable only the formats you want.

Monitor the Scan

PhotoRec shows a live counter of files found and sectors remaining. On a large spinning disk this can take hours. On an NVMe SSD with a focused file type list it often finishes in minutes. Do not interrupt it with Ctrl+C partway through — let it complete or the last batch of found files may not be written.

Find Your Recovered Files

PhotoRec writes files into numbered subdirectories inside your chosen destination:

ls /mnt/recovery/

You will see directories named recup_dir.1, recup_dir.2, and so on. Each contains up to 500 files. Filenames are replaced with a numeric identifier and the correct extension (e.g., f12345678.jpg), because PhotoRec cannot recover original filenames — those lived in the directory entry that was erased.

To get a quick count of what was found:

find /mnt/recovery -type f | wc -l

To list only a specific type, such as PDFs:

find /mnt/recovery -name "*.pdf" | head -40

Sort and Identify Files

With hundreds or thousands of files bearing generic names, sorting by type and then by content is the fastest approach. The file command reads magic bytes rather than trusting the extension:

file /mnt/recovery/recup_dir.1/*

To copy all JPEGs to a dedicated folder for easier review:

find /mnt/recovery -name "*.jpg" -exec cp {} /mnt/review/images/ \;

For documents, tools like strings can extract readable text fragments to help you identify which file is which:

strings /mnt/recovery/recup_dir.3/f00123456.doc | head -30

Verification

Open a recovered image with an image viewer to confirm it is intact. For archives:

zip -T /mnt/recovery/recup_dir.1/f00456789.zip

For PDFs, pdfinfo from poppler-utils is quick:

pdfinfo /mnt/recovery/recup_dir.2/f00654321.pdf

Partial files are common — PhotoRec recovers what it can. A file that was partially overwritten before recovery will be truncated or corrupted at the point of overwrite.

Troubleshooting

PhotoRec finds very few files

The disk has been heavily written since deletion. SSDs with TRIM enabled are especially problematic — TRIM signals the drive to zero freed blocks almost immediately, destroying the data PhotoRec needs. On TRIM-enabled SSDs your recovery window may be seconds to minutes, not days.

Permission denied on the device

Always run PhotoRec with sudo or as root. A non-root user cannot read raw block devices directly.

Recovered destination fills up

Stop the scan, free space or point to a larger destination, and restart. You can re-run PhotoRec on the same source; it will re-scan from the beginning. Consider using File Opt to target only the specific file types you need.

System partition cannot be unmounted

Boot a live USB of any Linux distro, install testdisk on it (sudo apt install testdisk or equivalent), mount your recovery destination, and run PhotoRec from the live environment. This is the cleanest approach for root partition recovery.