Skip to main content

Recover Deleted Files on an NTFS Hard Drive from a Ubuntu Live CD

Accidentally deleting a file is a terrible feeling. Not being able to boot into Windows and undelete that file makes that even worse. Fortunately, you can recover deleted files on NTFS hard drives from an Ubuntu Live CD.

To show this process, we created four files on the desktop of a Windows XP machine, and then deleted them. We then booted up the same machine with the Bootable Ubuntu USB Flash Drive.

Once Ubuntu 9.10 boots up, open a terminal by clicking Applications in the top left of the screen, and then selecting Accessories > Terminal.

sshot-1
To undelete our files, we first need to identify the hard drive that we want to undelete from. In the terminal window, type in:
sudo fdisk –l
and press enter.



What you’re looking for is a line that ends with HPSF/NTFS (under the heading System). In our case, the device is “/dev/sda1”. This may be slightly different for you, but it will still begin with /dev/. Note this device name.

If you have more than one hard drive partition formatted as NTFS, then you may be able to identify the correct partition by the size. If you look at the second line of text in the screenshot above, it reads “Disk /dev/sda: 136.4 GB, …” This means that the hard drive that Ubuntu has named /dev/sda is 136.4 GB large. If your hard drives are of different size, then this information can help you track down the right device name to use. Alternatively, you can just try them all, though this can be time consuming for large hard drives.

Now that you know the name Ubuntu has assigned to your hard drive, we’ll scan it to see what files we can uncover.

In the terminal window, type:
sudo ntfsundelete
and hit enter. In our case, the command is:
sudo ntfsundelete /dev/sda1


The names of files that can recovered show up in the far right column. The percentage in the third column tells us how much of that file can be recovered. Three of the four files that we originally deleted are showing up in this list, even though we shut down the computer right after deleting the four files – so even in ideal cases, your files may not be recoverable.

Nevertheless, we have three files that we can recover – two JPGs and an MPG.

Note: ntfsundelete is immediately available in the Ubuntu 9.10 Live CD. If you are in a different version of Ubuntu, or for some other reason get an error when trying to use ntfsundelete, you can install it by entering “sudo apt-get install ntfsprogs” in a terminal window.

To quickly recover the two JPGs, we will use the * wildcard to recover all of the files that end with .jpg.

 In the terminal window, enter
sudo ntfsundelete –u –m *.jpg
which is, in our case,
sudo ntfsundelete /dev/sda1 –u –m *.jpg

Hopefully you won’t need to use this tip, but if you do, ntfsundelete is a nice command-line utility. It doesn’t have a fancy GUI like many of the similar Windows programs, but it is a powerful tool that can recover your files quickly.



Comments

Popular posts from this blog

How To Recover Passwords Using Ophcrack LiveCD

Ophcrack LiveCD 3.4.0 is a completely self contained, bootable version of Ophcrack 3.4.0 - the easiest and most effective tool that I've ever found to "crack" your forgotten Windows password. For a quick overview of Ophcrack, see my complete review of Ophcrack 3.4.0 . Ophcrack is a free software program that recovers passwords so the first step you'll need to take is to visit Ophcrack's website . When the Ophcrack website loads as shown above, click the Download ophcrack LiveCD button. Note: Since you obviously can't get into your computer right now because you don't know the password, these first four steps will need to be completed on another computer that you have access to. This other computer will need to have access to the Internet and the capability to burn a disc (like a CD, DVD, etc.). Another Note: The instructions I've put together here walk you through the entire process of using Ophcrack LiveCD to recover your password. If you...

Linuxfx 10 : A Windows-Like Linux Distro

The idea of Linuxfx is to make it easier for people who are migrating from Windows 7. People who are dissatisfied with the lack of security and stability of Windows 10 are also fit for Linuxfx. LinuxFX Desktop : Apart from Windows-like looks, Linuxfx also has more to offer which a regular user will definitely admire. So, let’s get along with me to know more about Windows alternative Linuxfx. As usual, I started by downloading the ISO image of Linuxfx from the official site  here . Then, instead of dual-booting, I decided to install it on my VirtualBox to play safely. After finishing the basic configuration, as soon as I booted it, I noticed a Windows logo and system integrity check. That’s quite surprising because every Linux distro puts their own or OEM logo on that place. But I think Linuxfx wants to make migrating users feel like home from the beginning. Entering the boot menu, Linuxfx redirected and logged in to a live session. Whoah! it can also detect the system I’m using — a...

Share Registry Editor Favorite Keys Across Computers

if you spend a lot of time inside your registry editor, you might already know that you can use the Favorites feature to add in a bookmark to a specific key in the registry, saving you immense amounts of time when you need to check a bunch of different keys. But did you think about exporting that list so you can use it on any computer? Here’s the menu I’m talking about: For instance, here I’m adding in a favorite for the local machine’s Run key, used to launch applications across all users. Now when I use the menu item, it will navigate me instantly to that key in the registry, no matter where I currently am. As I added a few favorites, it occurred to me that I should figure out where those menu items are being stored… Now browse down to this registry key to find the favorites list: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit\Favorites And there’s the favorite we just saved… so how does this help you? If you export this r...