I accidentally removed some files on a NTFS partition
How can I recover them staying inside Linux without rebooting ?
Asked
Active
Viewed 1.6k times
6
-
Using TestDisk, click through device and type to Advanced.. in partition selection, pay attention to the bottom for Undelete. Then select a different drive to save to. I believe its possible to write a script using fls from TestDisk to recover from a single directory if that is needed or when the TD single selection is tedious.. see this answer here: unix.stackexchange.com/a/390174/346155 – alchemy Apr 30 '20 at 18:08
1 Answers
13
The Ubuntu Wiki has a lenghty topic on data recovery and, luckily for you, also has a segment on recovering files deleted from a NTFS partition. From that part of the link:
Ntfsprogs
ntfsprogs 
can recover deleted files from an NTFS file-system. The Windows and LiveCd versions have a very nice intuitive gui but the linux one is probably stronger and does not have a front-end gui at the moment.
Briefly, it has 3 modes
Scan. searches for deleted files and find info about themUndelete. See below.Copy.
When undeleting chose which files to undelete and where to undelete them too. By default this appears to be the desktop of the OS you are booted into, whether that is a LiveCd or on a different partition or drive. For a LiveCd or LiveUsb you will need to move them onto Usb-stick or safe partition before rebooting as the desktop gets forgotten on LiveCds unless you are using a Persistent image.
To search
ntfsundelete /dev/sda2
To undelete
ntfsundelete /dev/sda2 -u -i 3689 -o work.doc -d ~/output
This will write all recovered files (in this case word.doc) from/dev/sda2 (be sure to find out the device name of your NTFS partition) in a directory output inside your home directory.
For better information on using ntfsundelete please see the separate page NtfsUndelete, particularly the External Links there.
Besides the part of the wiki it also contains this external link explaining NtfsUndelete with images.
