Recover Removed Files from Windows NTFS Drive using Live Ubuntu DVD

29/12/2020
Chưa phân loại
If you’ve mistakenly deleted some files from your Windows NTFS drive and would like to get them back, then this article is for you.  In this article, I am going to show you how to recover removed files from your Windows NTFS drive using Ubuntu Live DVD. So, let’s get started.

Removing Files from Windows NTFS Drive:

I have some files in my NTFS formatted 32 GB USB thumb drive.

Now, I am going to remove all the JPG image files from this USB thumb drive. Let’s assume I removed them by mistake.

Oh no! My important files are gone.

If you remove some important files by mistake and would like to get them back, then I advise you to eject the drive as soon as possible. If you’re not able to eject the drive (if it’s an internal hard drive), then at least do not modify the contents of the drive (i.e add, remove, copy, cut files/directories from the drive). Doing so would reduce the chance of recovering these removed files.


Creating a Live Ubuntu Bootable USB:

Now, read the article Rufus Bootable USB to Install Ubuntu 18.04 LTS to create a new Live Ubuntu Bootable USB thumb drive and boot from it.  Once you boot from the USB thumb drive, Ubuntu should start in Live mode. Now, open the Terminal app.

Finding the NTFS Drive to Recover:

You can find the drive name with the following command:

$ sudo lsblk

As you can see, the 32 GB NTFS thumb drive is sdb1.

Now, unmount the NTFS drive with the following command:

$ sudo umount /dev/sdb1

Now, install ntfs-3g with the following command:

$ sudo apt install ntfs-3g

Now, press Y and then press <Enter> to confirm the installation.

ntfs-3g should be installed.

Now, check whether ntfsundelete command is available as follows:

$ whereis ntfsundelete

ntfsundelete is available in the path /sbin/ntfsundelete.

Finding Removed Files:

You can scan for removed files in the drive from where you’ve removed it as follows:

$ sudo ntfsundelete /dev/sdb1 –scan

As you can see, all the removed files are listed in a tabular format. You can find the Inode number of the removed files, how much of each file is recoverable (%age), the last modified date and time of the file, the size of the file (in bytes) and the name of the file.

In the end of the output, ntfsundelete will show you how many files can be recovered. In my case, I can recover 9 files.

You can also specify the scan criteria of the removed files.

If you already know the file size of the file(s) that you’re trying to recover, then you can specify a range of file size as follows:

$ sudo ntfsundelete /dev/sdb1 –size 700k-1M

NOTE: k = kilobyte, M/m = megabyte, g = gigabyte, t = terabyte

As you can see, the removed files in the file size range 700 KB to 1 MB is listed.

You can also tell ntfsundelete to list the files that were last modified since the last 60 months as follows:

$ sudo ntfsundelete /dev/sdb1 –time 60m

NOTE: d = days, w = weeks, m = months and y = years

If you know part of the filename or extension of the removed files, then you can find the removed files as follows:

$ sudo ntfsundelete /dev/sdb1 –match ‘*.jpg’

You can also search for files that has a certain percentage of content (let’s say 90%) you can recover as follows:

$ sudo ntfsundelete /dev/sdb1 –percent 90

Recovering Removed Files:

Let’s say, you want to recover the file with the Inode number 39.

To do that, you can run the following command:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 39

The file should be recovered and saved in the current working directory.

As you can see, the image file is saved in the current working directory.

$ ls -lh

You can also specify a range of Inodes of the files to recover as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 3942

You can also mix specific Inode number, and ranges of Inodes as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 39,4042,55,5962

By default, ntfsundelete rounds the file size to nearest multiples of 512 bytes (block size). So, the file size of the recovered file will be a little bit larger.

To avoid that, you can use the –truncate option as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –inodes 39

You can also specify an output file name as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –inodes 39 –output test.jpg

As you can see, the recovered image file is saved as test.jpg.

You can also specify a filename pattern to recover all the files that match the pattern altogether as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –match ‘*.jpg’

You can also save the recovered file in a specify directory.

First, create a new directory recovery/ as follows:

Now, recover the files and save them in the recovery/ directory as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –match ‘*.jpg’

The files will be recovered.

Now, add read and write permissions to the recovered files as follows:

$ sudo chmod -Rfv a+rw recovery/

Now, you can copy these files to a safe place.

I copied the recovered files to my 32 GB USB thumb drive.

So, that’s how you recover removed files from Windows NTFS drives using Live Ubuntu DVD. Thanks for reading this article.

ONET IDC thành lập vào năm 2012, là công ty chuyên nghiệp tại Việt Nam trong lĩnh vực cung cấp dịch vụ Hosting, VPS, máy chủ vật lý, dịch vụ Firewall Anti DDoS, SSL… Với 10 năm xây dựng và phát triển, ứng dụng nhiều công nghệ hiện đại, ONET IDC đã giúp hàng ngàn khách hàng tin tưởng lựa chọn, mang lại sự ổn định tuyệt đối cho website của khách hàng để thúc đẩy việc kinh doanh đạt được hiệu quả và thành công.
Bài viết liên quan

AppArmor Profiles on Ubuntu

AppArmor, a Linux Kernel Security Module, can restrict system access by installed software using application specific profiles. ...
28/12/2020

How to Install JDK 12 on CentOS 7

Java Development Kit (JDK) is used to develop and test Java applications. It is used by millions of Java developers around...
29/12/2020

Eclipse Java Tutorial

Eclipse Integrated Development Environment is an incredible open source compilation of tools, projects and co-existing working...
28/12/2020
Bài Viết

Bài Viết Mới Cập Nhật

mua Proxy riêng ở đâu, và nó đem lại lợi ích gì cho người sử dụng
22/11/2022

Hướng dẫn sử dụng Proxy Helper Fakeip khi thuê proxy
21/11/2022

PROXY NUÔI TÀI KHOẢN FACEBOOK – KINH NGHIỆM FAKE IP – THUÊ PROXY GIÁ RẺ
14/11/2022

Mua Proxy Nuôi Zalo Giá Rẻ Tại Onet.com.vn
14/11/2022

BẢNG GIÁ MUA PROXY VIỆT NAM và PROXY US Onet.com.vn
14/11/2022