0

This is a followup on my original post Recover accidentally deleted directory which may be deleted in the future.

In the process of backing up my audio books, I "permanently" removed a folder (with subfolders) that I had already exclusively moved to that drive. It's path is /media/gratis/Seagate Expansion Drive/Audiobooks/Jason Dark. The sole folder in that should be called John Sinclair; but I'm not sure about that.

Which tool offers the best chances to recover those files? I haven't written plenty on that drive afterwards; so I hope for the best. It's not that other methods failed; I just cant get my head around what to do and I want to be cautious. It's a NTFS Drive.

According to testdisk it has an "EFI GPT" Partition table.

Disk /dev/sdb - 5000 GB / 4657 GiB - CHS 608001 255 63, sector size=512 - Seagate Expansion Desk, FW:9401

Information According to "Disks" (Ubuntu Standard Software):

NTFS; GUID Partition Table; [...] Partition Type: Microsoft Reserved

Attempt 1: First off, ntfsprogs seems to no longer be in repos (those mentioned by another user); but it is already installed on my machine so no problems there. I always get the error:

Access is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command. You can use force option to avoid this check, but this is not recommended and may lead to data corruption.

Although I only just plugged it in and even quit Nautilus by force (nautilus -q).

Therefore, I ran sudo ntfsundelete /dev/sdb2 -f. That gave me a list of a bunch of files, 205013 to be exact. Now, what I want is the content of the directory .../Audiobooks/Jason\ Dark/ to be restored. What do I have to do? It's contents are .m4b & .opus files and folders, of course.

David Foerster
  • 36,264
  • 56
  • 94
  • 147
Markus Gratis
  • 697
  • Is the file system in question mounted? You need to unmount it, e. g. with udisksctl unmount --block-device /dev/sdb2 or sudo umount /dev/sdb2 (replace sdb with whatever the kernel name of the drive is currently). – David Foerster Jun 04 '17 at 12:02
  • Why did you open a new question? The original question could have been integrated with the information and probably going to be reopened soon. Actually the original question already has reopen votes. – Andrea Lazzarotto Jun 05 '17 at 09:27
  • See also a complete solution to your problem here: https://superuser.com/a/1144489/278831 – Andrea Lazzarotto Jun 05 '17 at 09:29
  • @AndreaLazzarotto: That's what another user suggested; and since I'm inexperienced in what is common in forums, thats what I did.

    I will try to work with the link you provided (I did read some ntfsundelete tutorial) but I was hoping for a short series of concrete commands or steps in a gui because I thought I had sufficiently outlined my problem.

     – Markus Gratis Jun 05 '17 at 16:37
  • @DavidFoerster:

    gratis@Zarathustra:~$ sudo umount /dev/sdb2 gratis@Zarathustra:~$ sudo ntfsundelete /dev/sdb2 Volume is scheduled for check. Please boot into Windows TWICE, or use the 'force' option. NOTE: If you had not scheduled check and last time accessed this volume using ntfsmount and shutdown system properly, then init scripts in your distribution are broken. Please report to your distribution developers (NOT to us!) that init scripts kill ntfsmount or mount.ntfs-fuse during shutdown instead of proper umount.

    & same if I use udisksctl unmount --block-device /dev/sdb2 first

     – Markus Gratis Jun 05 '17 at 16:45
  • 1
    Could you please [edit] your post, when you want to add information? Especially file or program output listings (with the help of the {} button in the editor toolbar) will be much more readable there; alternatively you can use a pastie service for longer listings and include the link of your pastie in your question. Overall it’s best to have everything relevant in one place. Additionally, comments may be deleted for various reasons. Thanks. – David Foerster Jun 05 '17 at 16:49
  • "I was hoping for a short series of concrete commands or steps" OK this is basically what was provided in the SuperUser answer linked above. – Andrea Lazzarotto Jun 05 '17 at 18:04
  • @AndreaLazzarotto: ok, thanks for that, Andrea!

    I'm just running the deep analysis via testdisk which will take a while.

     – Markus Gratis Jun 06 '17 at 18:19

0 Answers0