How to recover most recently deleted directories on NTFS partition

Question

In Nautilus under Ubuntu 12.04, I accidentally selected several directories on a partition and deleted them at once (unfortunately, I deleted them by Shift+Delete such that they don't remain in Trash). I haven't written any new data to that partition yet since the deletion. I wonder what ways I can try to recover them? Note that the partition is NTFS, shared between Windows 7 and Ubuntu 12.04.

Following is different software that I have tried so far.

1. I have also tried to use Sleuthkit, but I cannot figure out how to use it.

   I have been running sudo fls -f ntfs -d -r -p /dev/sda3 > ~/deleted_files.txt for almost a week on my 110GB 96%-used ntfs partition. It hasn't finished running yet (don't know when it will), and the file ~/deleted_files.txt is still empty. All my work has been stalled since I don't dare to write any data to the partition.

   Now I wonder if my usage of sleuthkit is the quickest way to identify most recently deleted directories and files in my case?

2. I installed TestDisk 6.13 via apt-get install, and followed http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk to recover the deleted directories and the files in them. But what is shown by TestDisk is not the deleted file/directory names as shown in the picture in the link, but files named by inode numbers:

   TestDisk 6.13, Data Recovery Utility, November 2011
   Christophe GRENIER <grenier@cgsecurity.org>
   http://www.cgsecurity.org
    3 P HPFS - NTFS           9291  38 28 23650 187 25  230686720 [Data]
   Deleted files
   
   >inode_13285                           30-Jan-2011 20:55     29427
    inode_13285:Zone.Identifier           30-Jan-2011 20:55        26
    inode_164258                          11-Aug-2011 13:16      2993
    inode_307016                          12-Feb-2011 09:34      1808
    inode_307017                          12-Feb-2011 09:34     10254
    inode_307018                          12-Feb-2011 09:34     13155
    inode_307019                          12-Feb-2011 09:34      7586
    inode_307020                          12-Feb-2011 09:34      7344
    inode_307021                          12-Feb-2011 09:34      6943
    inode_307022                          12-Feb-2011 09:34      6081
    inode_307023                          12-Feb-2011 09:34     24043
    inode_314965                          12-Feb-2011 09:36    112947
    inode_314983                          12-Feb-2011 09:36     23581
    inode_314984                          12-Feb-2011 09:36      8486
    inode_314985                          12-Feb-2011 09:36       158
    inode_314986                          12-Feb-2011 09:36        45
                                                      Next
   Use : to select the current file, a to select/deselect all files,
       C to copy the selected files, c to copy the current file, q to quit
   

   When I hit a and then C to select and copy all the selected files, files named inode_xxxxxx will be copied to a directory that I specify.

   Also, I don't know the meaning of the date and time for each file shown by TestDisk. Does it mean the deletion date and time or last update date and time before deletion? (Note the most recent date and time shown by TestDisk is 30-Jul-2012 20:53, which is not today when the accidental deletion happened.)

   How can I figure out which files are my most recently deleted ones, and how can I recover them?

   Can I find out and recover my most recently deleted directories instead of just files?

3. I am also curious to know if these two links to How-to really work?

   In http://www.ehow.com/how_5202235_retrieve-deleted-files-linux.html, grep -b 'search-text' /dev/partition > file.txt is used to search for the deleted files.

   In http://www.ehow.com/how_7517984_restore-overwritten-file-linux.html, the "Isdel" command is used.

What other software can I try besides TestDisk and Sleuthkit?

Answer 1

If you use fls -r, then it will go recursively through all the directories, which might not be exactly what you need for your goal here. Try using fls in more interactive way, just like ls. Also, using mactime to process output can be helpful to navigate to relevant dirs/files.

mactime puts all files to timeline, marking when each of them was modified (m), accessed (a), (attribute-)changed (c) or born (b). Because files can be born and modified in separate times, you'll see some same filenames on separate lines.

For example, use fls -m X: /dev/sda3 | mactime -b - to get listing of the top directory, sorted in time. Deleted files are marked with (deleted). You'll see also a lot of maintenance data stores which are normally hidden in windows explorer.

In case of NTFS there is a 3-number combination like x-y-z designating file ID in the filesystem. For normal directories, y should be 144.

Use fls -m X: /dev/sda3 x-y-z | mactime -b - to get listing of directory you are interested in.

Recovering is done similarly using file IDs: icat /dev/sda3 x-y-z >recovered_file

Answer 2

Data recovery tools in Linux are very weird and rare in between even more that works on NTFS filesystems. So, if you want a tool that recovers the meta-data of the file and present them, if it's not one of the proposed, ntfsundelete, PhotoRec (Sleuthkit) or TestDisk; I would recommend using Windows-only tools for the task.