Question

Suppose I have a deleted file in my unallocated space on a linux partition and i want to retrieve it.

Suppose I can get the start address of the file by examining the header.

Is there a way by which I can estimate the number of blocks to be analyzed hence (this depends on the size of the image.)

Answer 1

In general, Linux/Unix does not support recovering deleted files – if it is deleted, it should be gone. This is also good for security – one user should not be able to recover data in a file that was deleted by another user by creating huge empty file spanning almost all free space.

Some filesystems even support so called secure delete – that is, they can automatically wipe file blocks on delete (but this is not common).

You can try to write a utility which will open whole partition that your filesystem is mounted on (say, /dev/sda2) as one huge file and will read it and scan for remnants of your original data, but if file was fragmented (which is highly likely), chances are very small that you will be able to recover much of the data in some usable form.

Having said all that, there are some utilities which are trying to be a bit smarter than simple scan and can try to be undelete your files on Linux, like extundelete. It may work for you, but success is never guaranteed. Of course, you must be root to be able to use it.

And finally, if you want to be able to recover anything from that filesystem, you should unmount it right now, and take a backup of it using dd or pipe dd compressed through gzip to save space required.