3. Preparation

Unmount the partition where you got your deleted files at. I will denote that partition with /dev/hdx1.

# umount /dev/hdx1

Check the size in blocks of /dev/hdx1.

# fdisk -l /dev/hdx

Now you need to have an extra partition of the same size as /dev/hdx1, to be able to act safely. Suppose that you have an empty harddrive located at /dev/hdy.

# fdisk /dev/hdy

Create a partition with the same size as /dev/hdx1. Here size is the size in blocks (each block is 1024 kB) of /dev/hdx1 taken from above.

fdisk: n <- Add a new partition. fdisk: p <- Primary partition. fdisk: <- Just press return to chose the default first cylinder. fdisk: +sizeK <- Make a partition of the same size as /dev/hdx1. fdisk: w <- Write table to disk and exit.

Now copy the content of the original partition to that extra one.

# dd if=/dev/hdx1 of=/dev/hdy1 bs=1k

This process may take quite a long time dependent of how big the partition is. You can get the job done faster by increasing the blocksize, bs, but then you need to get the division of the partition by bs to have a remainder of zero.

From now on we will only work with that copy of the source partition to be able to step back if something goes wrong.