Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In Nautilus under Ubuntu 12.04, I accidentally selected several directories on a partition and deleted them at once (unfortunately, I deleted them by Shift+Delete such that they don't remain in Trash). I haven't written any new data to that partition yet since the deletion. I wonder what ways I can try to recover them? Note that the partition is NTFS, shared between Windows 7 and Ubuntu 12.04.

Following is different software that I have tried so far.

  1. I have also tried to use Sleuthkit, but I cannot figure out how to use it.

    I have been running sudo fls -f ntfs -d -r -p /dev/sda3 > ~/deleted_files.txt for almost a week on my 110GB 96%-used ntfs partition. It hasn't finished running yet (don't know when it will), and the file ~/deleted_files.txt is still empty. All my work has been stalled since I don't dare to write any data to the partition.

    Now I wonder if my usage of sleuthkit is the quickest way to identify most recently deleted directories and files in my case?

  2. I installed TestDisk 6.13 via apt-get install, and followed http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk to recover the deleted directories and the files in them. But what is shown by TestDisk is not the deleted file/directory names as shown in the picture in the link, but files named by inode numbers:

    TestDisk 6.13, Data Recovery Utility, November 2011
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org
     3 P HPFS - NTFS           9291  38 28 23650 187 25  230686720 [Data]
    Deleted files
    
    >inode_13285                           30-Jan-2011 20:55     29427
     inode_13285:Zone.Identifier           30-Jan-2011 20:55        26
     inode_164258                          11-Aug-2011 13:16      2993
     inode_307016                          12-Feb-2011 09:34      1808
     inode_307017                          12-Feb-2011 09:34     10254
     inode_307018                          12-Feb-2011 09:34     13155
     inode_307019                          12-Feb-2011 09:34      7586
     inode_307020                          12-Feb-2011 09:34      7344
     inode_307021                          12-Feb-2011 09:34      6943
     inode_307022                          12-Feb-2011 09:34      6081
     inode_307023                          12-Feb-2011 09:34     24043
     inode_314965                          12-Feb-2011 09:36    112947
     inode_314983                          12-Feb-2011 09:36     23581
     inode_314984                          12-Feb-2011 09:36      8486
     inode_314985                          12-Feb-2011 09:36       158
     inode_314986                          12-Feb-2011 09:36        45
                                                       Next
    Use : to select the current file, a to select/deselect all files,
        C to copy the selected files, c to copy the current file, q to quit
    

    When I hit a and then C to select and copy all the selected files, files named inode_xxxxxx will be copied to a directory that I specify.

    Also, I don't know the meaning of the date and time for each file shown by TestDisk. Does it mean the deletion date and time or last update date and time before deletion? (Note the most recent date and time shown by TestDisk is 30-Jul-2012 20:53, which is not today when the accidental deletion happened.)

    How can I figure out which files are my most recently deleted ones, and how can I recover them?

    Can I find out and recover my most recently deleted directories instead of just files?

  3. I am also curious to know if these two links to How-to really work?

    In http://www.ehow.com/how_5202235_retrieve-deleted-files-linux.html, grep -b 'search-text' /dev/partition > file.txt is used to search for the deleted files.

    In http://www.ehow.com/how_7517984_restore-overwritten-file-linux.html, the "Isdel" command is used.

What other software can I try besides TestDisk and Sleuthkit?

share|improve this question
    
$ ntfsundelete ? (ntfsprogs) –  elv Aug 23 '12 at 14:12
    
@elv: It seems that ntfsundelete doesn't support to find deleted files by their deletion time, but only their "altering time", which make it difficult to recover the directories/files deleted at once last time. Correct me if I am wrong. –  Tim Aug 23 '12 at 15:02
1  
Consider remounting your partition read-only, so that no daemon or other program accidentally writes to the partition for you. –  SkyDan Jun 10 at 6:16
    
When you get out of this mess, if you do. Have a look at revision control tools such as mercurial. You don't want to be in this mess again. –  richard Jun 16 at 21:52

1 Answer 1

Data recovery tools in Linux are very weird and rare in between even more that works on NTFS filesystems. So, if you want a tool that recovers the meta-data of the file and present them, if it's not one of the proposed, ntfsundelete, PhotoRec (Sleuthkit) or TestDisk; I would recommend using Windows-only tools for the task.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.