In Nautilus under Ubuntu 12.04, I accidentally selected several directories on a partition and deleted them at once (unfortunately, I deleted them by Shift+Delete such that they don't remain in Trash). I haven't written any new data to that partition yet since the deletion. I wonder what ways I can try to recover them? Note that the partition is NTFS, shared between Windows 7 and Ubuntu 12.04.
Following is different software that I have tried so far.
I have also tried to use Sleuthkit, but I cannot figure out how to use it.
I have been running
sudo fls -f ntfs -d -r -p /dev/sda3 > ~/deleted_files.txtfor almost a week on my 110GB 96%-used ntfs partition. It hasn't finished running yet (don't know when it will), and the file
~/deleted_files.txtis still empty. All my work has been stalled since I don't dare to write any data to the partition.
Now I wonder if my usage of sleuthkit is the quickest way to identify most recently deleted directories and files in my case?
I installed TestDisk 6.13 via apt-get install, and followed http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk to recover the deleted directories and the files in them. But what is shown by TestDisk is not the deleted file/directory names as shown in the picture in the link, but files named by inode numbers:
TestDisk 6.13, Data Recovery Utility, November 2011 Christophe GRENIER <firstname.lastname@example.org> http://www.cgsecurity.org 3 P HPFS - NTFS 9291 38 28 23650 187 25 230686720 [Data] Deleted files >inode_13285 30-Jan-2011 20:55 29427 inode_13285:Zone.Identifier 30-Jan-2011 20:55 26 inode_164258 11-Aug-2011 13:16 2993 inode_307016 12-Feb-2011 09:34 1808 inode_307017 12-Feb-2011 09:34 10254 inode_307018 12-Feb-2011 09:34 13155 inode_307019 12-Feb-2011 09:34 7586 inode_307020 12-Feb-2011 09:34 7344 inode_307021 12-Feb-2011 09:34 6943 inode_307022 12-Feb-2011 09:34 6081 inode_307023 12-Feb-2011 09:34 24043 inode_314965 12-Feb-2011 09:36 112947 inode_314983 12-Feb-2011 09:36 23581 inode_314984 12-Feb-2011 09:36 8486 inode_314985 12-Feb-2011 09:36 158 inode_314986 12-Feb-2011 09:36 45 Next Use : to select the current file, a to select/deselect all files, C to copy the selected files, c to copy the current file, q to quit
When I hit
Cto select and copy all the selected files, files named
inode_xxxxxxwill be copied to a directory that I specify.
Also, I don't know the meaning of the date and time for each file shown by TestDisk. Does it mean the deletion date and time or last update date and time before deletion? (Note the most recent date and time shown by TestDisk is 30-Jul-2012 20:53, which is not today when the accidental deletion happened.)
How can I figure out which files are my most recently deleted ones, and how can I recover them?
Can I find out and recover my most recently deleted directories instead of just files?
I am also curious to know if these two links to How-to really work?
grep -b 'search-text' /dev/partition > file.txtis used to search for the deleted files.
In http://www.ehow.com/how_7517984_restore-overwritten-file-linux.html, the "Isdel" command is used.
What other software can I try besides TestDisk and Sleuthkit?
ntfsundeletedoesn't support to find deleted files by their deletion time, but only their "altering time", which make it difficult to recover the directories/files deleted at once last time. Correct me if I am wrong.