Recover lost files with a live Linux USB

Data loss rarely arrives with a warning. A laptop may no longer boot after a storm or bushfire-related power outage, a drive may vanish after moving between a Sydney office and a home in regional New South Wales, or files may disappear after an upgrade. In Australia, the trusty “USB stick” is familiar, but the wrong recovery move can make a recoverable problem permanent.

A live Linux USB boots an entire operating system into RAM, without installing over the internal drive. You get a file manager and terminal that can inspect storage, copy documents and run recovery tools even when the installed Windows or Linux system will not start.

This clean separation is useful when the operating system is damaged, partitions are confused, or normal startup keeps writing to the disk. A current distribution can read common NTFS, FAT and ext file systems and work independently of the broken installation.

The plan is simple: identify the affected device, keep it read-only where possible, copy visible files, and recover anything else to separate storage. A methodical approach gives you a fair dinkum chance without turning a logical problem into physical damage.

Why a live Linux USB helps data recovery

A live environment avoids dependence on the desktop system you were trying to rescue. It can start from an external SSD or USB stick, while its temporary changes disappear when you shut down. That makes it suitable for deleted-file recovery, partition inspection, disk imaging and data transfer.

It does not repair failed hardware. Clicking, grinding, missing capacity or repeated I/O errors can mean the drive is failing, and rescue software may accelerate the decline. In those cases, stop repeated attempts and use an established data recovery service. Software is best suited to logical faults, accidental deletion and lightly damaged file systems.

Choose a recovery-focused distribution

Choose a current, reputable distribution with a live desktop, a terminal and the file-system tools you need. Ubuntu, Fedora and Linux Mint are common starting points, although a smaller specialist rescue system may be more convenient. For older hardware, a lightweight image can avoid memory and graphics problems.

Download the ISO only from a trustworthy source, then compare its checksum with the value published by the project. A directory such as Linux download options can be useful for comparing releases, but the project’s own site should remain your final reference. Record the image name and checksum before writing it; those details matter if the USB will not boot.

Create a dependable bootable USB

Use a new 8 GB or larger USB stick, or a 16 GB drive for more room. This must be separate from the storage being rescued. Copy anything important off the stick first, because creating the boot media will erase it. A USB 3 drive is quicker, but reliability matters more than speed.

Use Rufus on Windows, balenaEtcher on Windows or macOS, or a suitable Linux imaging utility. Select the downloaded ISO and the correct USB device, then verify the target before writing. Avoid “auto-install” modes that add unnecessary settings; the standard image mode is usually enough for a live session.

Before booting, disconnect other USB storage adapters and secondary hard disks so the wrong drive cannot be selected. If the affected PC still runs Windows, avoid cleanup utilities until the recovery copy is complete; this registry cleaner guide explains why such tools can change configuration without restoring deleted data. Never run repair software merely to see what happens.

Boot into the live environment

Reboot the computer and use its boot-device menu, commonly F12, F10, Esc or F9, then choose the USB. Some machines require a one-time boot order change in firmware. If the live desktop appears, the image is working. Choose the live “Try” session, not “Install”.

If booting fails, check the USB port, disable Secure Boot only when necessary, and confirm that the computer’s firmware supports UEFI for a 64-bit image. Some older machines need the legacy BIOS mode offered by certain distributions. It is fair to give it a go with another port before rewriting the same media.

Open a terminal in the live desktop and use lsblk -o NAME,SIZE,MODEL,FSTYPE,MOUNTPOINTS to see attached disks and partitions. Compare sizes and model names with the drive you need. Device names can change between systems, so never rely on a remembered /dev/sda; read the list each time.

Inspect and mount storage safely

Before opening files, identify the file system and make sure the partition is mounted read-only. If the live desktop has mounted it automatically, unmount it with sudo umount /dev/sdX2, substituting the exact partition from lsblk. Then create a mount point with sudo mkdir -p /mnt/recovery and use a read-only mount, such as sudo mount -o ro /dev/sdX2 /mnt/recovery.

NTFS, exFAT and ext4 may need slightly different drivers or utilities, so if the mount fails, read the error rather than forcing it. norecover can be added for some ext file systems, but it is not valid everywhere. A refusal to mount may itself be evidence of damage, not a reason to format or repair.

Use the file manager to browse only after checking the mount path. Copy directories you recognise to a separate drive first, preserving folders and file names when possible. If reads cause long pauses or errors, stop. Each attempt on a failing drive adds stress, and a specialist is safer when the original data has real business or personal value.

Recover files and preserve an image

Start with ordinary copying. Files in the Recycle Bin, recent folders, desktop and documents may be visible even when the index is broken. Save them to healthy storage with enough free space, and keep that destination separate from the source. Do not save recovered files back onto the suspect partition.

For deleted files, TestDisk can analyse partition tables and some file systems, while PhotoRec can carve files from unallocated space by their signatures. PhotoRec is useful when directory entries are gone, but recovered names and original folder structures may be lost. Run either tool only after the device and destination are confirmed, and avoid writing partition-table changes directly to the original.

When reads produce I/O errors, image the drive before deeper analysis. GNU ddrescue can copy a failing disk to a healthy external drive with sudo ddrescue /dev/sdX /path/recovery.img /path/rescue.log. The destination must have capacity larger than the source and must not be another partition on it. A second pass with the -d option can target gaps more slowly, and you should work on the image rather than the original.

Recover methodically and protect what you find

Use a recovery checklist that keeps the source stable and the rescued data organised. Work through these steps in order, and record which actions have already been tried so you do not repeat them.

Start now by downloading a verified live image, creating a bootable USB on separate media and rehearsing the boot process on a healthy computer. Then identify the affected drive, make your first read-only copy and store rescued files elsewhere. Recovering data should feel systematic, not heroic: protect the original first and preserve every successful copy.