3. Preparation

Unmount the partition where you got your deleted files at. I will denote that partition with /dev/hdx1.

        # umount /dev/hdx1

Check the size in blocks of /dev/hdx1.

        # fdisk -l /dev/hdx

Now you need to have an extra partition of the same size as /dev/hdx1, to be able to act safely. Suppose that you have an empty harddrive located at /dev/hdy.

        # fdisk /dev/hdy

Create a partition with the same size as /dev/hdx1. Here size is the size in blocks (each block is 1024 kB) of /dev/hdx1 taken from above.

Note: I am using fdisk version 2.10f and if you have another version the fdisk interaction below may not be the same.

        fdisk: n      <- Add a new partition.
        fdisk: p      <- Primary partition.
        fdisk:        <- Just press return to chose the default first cylinder.
        fdisk: +sizeK <- Make a partition of the same size as /dev/hdx1.
        fdisk: w      <- Write table to disk and exit.

Now copy the content of the original partition to that extra one.

        # dd if=/dev/hdx1 of=/dev/hdy1 bs=1k

This process may take quite a long time dependent of how big the partition is. You can get the job done faster by increasing the blocksize, bs , but then you need to get the division of the partition by bs to have a remainder of zero.

From now on we will only work with that copy of the source partition to be able to step back if something goes wrong.