Recover files on Linux from NTFS partition


DISASTER!

I usually have a *NTFS* partition to share files between *OS X, Windows and Linux*. Without wishing I deleted some files from this partition. Today I'll try to recover it **without installing any software on my Linux distribution and in four easy steps...**

---

There are too many file recovery programs. My favorite is [TestDisk](http://www.cgsecurity.org/wiki/TestDisk), but it's not for everyone. Today I'm going to show you how to recover files with an application that is already installed in most *Linux* distributions. It is [ntfsundelete](http://linux.die.net/man/8/ntfsundelete).

sudo fdisk -l. Click for enlarge

1) **Unmount the NTFS partition:** If you don't know what is it, use the command **sudo fdisk -l**. Now create a directory where the files will be recovered and *cd* into it.

2) Run the following in the terminal:

sudo ntfsundelete /dev/sdaX | grep 100% | awk '{print $1, substr($0, index($0,$7)) }'

Where X is the *NTFS* partition. You will see the files that have a recover probability of 100%. If you don't want to be so strict, delete the previous pipe **| grep 100%**. I used *pipes* to display the data that really care.

.png files list deleted. Click to enlarge

If you just want to recover such files with extension *.png*, add the parameter **-m \*.png** to ntfsundelete.

3) Now we have several recovering ways. I'll try to recover the file *gpu_performance.png*:

• **By Inode:** The first column shows the *Inode*. We would type:

sudo ntfsundelete /dev/sda5 -u -i 11812

• **By file name:**

sudo ntfsundelete /dev/sda5 -u -m gpu_performance.png

Supports *wildcards*, so to retrieve all *.png* files, we must to use *-m *.png*

• **By time:** In this example, we retrieve all files two days ago (2d).

sudo ntfsundelete /dev/sda5 -u -t 2d

You can use *d, w, m, y* for days, weeks, months or years ago.

Perfectly recover the file and change the permissions. Click for enlarge

4) **Change root permissions:** Finally, we recovered the file as *root*. We need to change the permissions:

sudo chown your_user *

I hope it helped you and if you see me, buy me a beer.