Undelete Windows files in Ubuntu Linux

There are many ways to recover mistakenly deleted files. Most OSs provide some kind of trash function or "Recycle Bin", which allows you to very easily undelete files. There are, however, situations when that is not possible. When is that, Indelible Bonobo, you may ask? Here are the reasons why the Recycle Bin might not work:

  1. You disabled it to save disk space and because you thought you would never use it.
  2. You got accustomed to bypass it by pressing Shift+Delete every time you delete a file, which is almost the same as disabling the Recycle Bin.
  3. All of the above, mostly because you don't know that you can fine tune the amount of space the Recycle Bin uses, as a percentage of your entire hard drive.
  4. The file you deleted is larger than the size of your Recycle Bin, causing it to be completely wiped out.
Windows itself has a large selection of tools you can use to recover deleted files. Most of them are, unfortunately, commercial and we will not consider them. Of the free tools, we have used in the past successfully the wonderful TestDisk which shines not with discrete files, but rather with lost or corrupt partitions. For undeleting files, there are numerous portable options. Portable Freeware's Files Recovery section lists well over 20 freeware applications that are also portable. Portability is important, because you want to be able to run the program from another disk or partition such as a USB stick. This way, the partition or disk you want to recover files from will be undisturbed, greatly increasing the chances of a successful recovery. Under linux, things are a bit more complicated. Most programs (e2undel, recover) are able to recover files deleted under ext2fs and not under ext3fs. This is useless to users who run ext3fs. For them, the only hope is ext3grep. But what if you have a multiboot system and deleted files on the Windows partition? In my case, I have a Ubuntu, Windows XP and a BSD flavour installed on the same system and at boot time I get to choose what OS I fancy. I usually fancy Ubuntu, because installing BSD has rendered Windows unbootable. Although I've done everything right in GRUB (the linux booter), Windows no longer boots. I wasn't in a hurry to fix this problem, as it forced me to really make Linux work as a substitute and I'm quite happy with it now. I have obviously configured access to my Windows partitions with ntfs-3g and use them frequently. That's how I recently deleted accidentally a large chung of files on the windows partition. Undeleting NTFS files under Windows is a breeze, that that's not what I wanted. I don't want to fix Windows now, especially with the deleted files situation, as that would decrease the chances of a successful recovery. I'd much rather undelete the files from linux, as that is the most convenient and has the greatest chance of success. There are two Ubuntu packages available for this purpose, magicrescue and ntfs-progs, the first being more geeky and the second being more complete. They can be installed with the graphical Synaptica Package Manager (System -> Administration) or by simply typing in a terminal window <code>sudo apt-get install ntfs-progs</code>. Before using ntfsundelete, you will have to unmount (umount /dev/sdb1) that partition, as the program prefers exclusive access (you can force it, but that's not nice). Continue then with ntfsundelete -s /dev/sdb1 and from there on you should be able to manage. Besides, I really have to go :)

blog comments powered by Disqus
Your gift enables us to continue to provide high quality reporting with little or no advertising.