CF Card Undelete for Linux

I hope you never need this. But this worked for me.

I accidentally deleted a bunch of files from the CF card that was in my card reader. I recovered them all perfectly.

First, before you do anything else, unmount the card’s file system. This will stop any additional changes being made to the card.

You’ll need to know:

  1. the device name of the card’s file system. It could be something as simple as /dev/sda1, or it could be something complex, like /dev/scsi/host1/bus0/target0/lun0/part1 (as it is with me).
  2. the names of the files you accidentally deleted. For example, if you deleted dsc_1017.jpg and dsc_1018.jpg in the dcim/100ncd70 directory, you’ll specify these as /dcim/100ncd70/dsc_1017.jpg and /dcim/100ncd70/dsc_1018.jpg.

First, check that the files can be undeleted:

# fsck.vfat -u /dcim/100ncd70/dsc_1017.jpg -u /dcim/100ncd70/dsc_1018.jpg /dev/scsi/host1/bus0/target0/lun0/part1

If you get the message Warning: did not undelete file ..., that’s a file that has been overwritten, perhaps in your camera. It’s gone; only the name remains. You won’t get it back.

Then, you can actually restore the files:

# fsck.vfat -r -u /dcim/100ncd70/dsc_1017.jpg -u /dcim/100ncd70/dsc_1018.jpg /dev/scsi/host1/bus0/target0/lun0/part1

If all goes well, your files will be back. Makes backups, and don’t do it again.