File recovery in Linux involves techniques and tools to restore accidentally deleted, corrupted, or lost files. Unlike traditional Windows systems, files in Linux are often recoverable if detected early since deletion usually involves only the removal of directory pointers, not the file contents. Various utilities are available to assist in recovering data from different file systems such as ext4, XFS, and ZFS.

—

• **Common Linux File Recovery Tools and Techniques**

   * **TestDisk**  
     [[TestDisk]] is an open-source recovery tool that helps recover lost partitions and repair boot sectors. It supports multiple file systems and can restore deleted files effectively.

   *GitHub Repository:* https://github.com/cgsecurity/testdisk  
   *Documentation:* https://www.cgsecurity.org/wiki/TestDisk

 * **PhotoRec**  
   A companion to [[TestDisk]], [[PhotoRec]] specializes in recovering specific file types like images, documents, and archives from damaged or formatted disks.

   *GitHub Repository:* https://github.com/cgsecurity/testdisk  
   *Documentation:* https://www.cgsecurity.org/wiki/PhotoRec

 * **extundelete**  
   This utility focuses on recovering deleted files from [[ext3]] and [[ext4]] file systems by restoring inode metadata.

   *GitHub Repository:* https://github.com/extundelete/extundelete  
   *Documentation:* https://extundelete.sourceforge.net/

 * **foremost**  
   [[foremost]] is a forensic recovery tool that extracts data based on file headers, footers, and internal structures. It’s useful for recovering a variety of file types.

   *GitHub Repository:* https://github.com/junegunn/foremost  
   *Documentation:* https://foremost.sourceforge.net

 * **The Sleuth Kit (TSK)**  
   [[TSK]] provides a collection of command-line tools for investigating disk images and recovering lost files. It is widely used in digital forensics.

   *GitHub Repository:* https://github.com/sleuthkit/sleuthkit  
   *Documentation:* https://www.sleuthkit.org

—

• **Recovery Techniques by File System**

   * **ext3/ext4**  
     Tools like [[extundelete]] and [[TestDisk]] are highly effective at recovering files from these file systems. If journaling is enabled, recovery chances improve by analyzing metadata.

 * **XFS**  
   [[XFS]] offers limited recovery options due to its metadata journaling. However, tools such as `xfs_repair` and utilities within the [[XFS]] toolset help repair corrupted file systems.

   *XFS Tools Repository:* https://github.com/sgi-xfs/xfsprogs

 * **ZFS**  
   [[ZFS]] provides built-in data integrity checks and snapshots that allow users to roll back to previous states. In case of data loss, restoring from a [[ZFS]] snapshot is a common recovery approach.

   *OpenZFS Repository:* https://github.com/openzfs/zfs  

—

• **Best Practices for Linux File Recovery**

   * **Stop Using the Affected Device Immediately**  
     Continued use can overwrite the deleted files, making recovery impossible.

 * **Use Live Boot Environments**  
   Boot from a live [[Linux]] USB or CD to perform recovery operations without affecting the existing file system.

 * **Enable Snapshots and Backups**  
   File systems like [[Btrfs]] and [[ZFS]] support snapshots, which allow quick rollback to a previous state in case of accidental file deletion.

 * **Automate Backups**  
   Use tools like [[rsync]] or [[Timeshift]] to maintain periodic backups of critical data to minimize recovery needs.

—

Recovering files on a Linux system is achievable using the right tools and techniques, provided that immediate action is taken to prevent data overwriting. Tools like TestDisk, extundelete, and foremost are invaluable for different file systems and recovery scenarios. While some file systems like XFS and ZFS offer limited direct recovery capabilities, their reliance on snapshots and robust data management minimizes data loss risks. Adopting preventive measures such as automated backups and snapshots ensures greater resilience in the event of accidental deletion or corruption.