Recover Removed Files from Windows NTFS Drive using Live Ubuntu DVD

29/12/2020
Chưa phân loại
If you’ve mistakenly deleted some files from your Windows NTFS drive and would like to get them back, then this article is for you.  In this article, I am going to show you how to recover removed files from your Windows NTFS drive using Ubuntu Live DVD. So, let’s get started.

Removing Files from Windows NTFS Drive:

I have some files in my NTFS formatted 32 GB USB thumb drive.

Now, I am going to remove all the JPG image files from this USB thumb drive. Let’s assume I removed them by mistake.

Oh no! My important files are gone.

If you remove some important files by mistake and would like to get them back, then I advise you to eject the drive as soon as possible. If you’re not able to eject the drive (if it’s an internal hard drive), then at least do not modify the contents of the drive (i.e add, remove, copy, cut files/directories from the drive). Doing so would reduce the chance of recovering these removed files.


Creating a Live Ubuntu Bootable USB:

Now, read the article Rufus Bootable USB to Install Ubuntu 18.04 LTS to create a new Live Ubuntu Bootable USB thumb drive and boot from it.  Once you boot from the USB thumb drive, Ubuntu should start in Live mode. Now, open the Terminal app.

Finding the NTFS Drive to Recover:

You can find the drive name with the following command:

$ sudo lsblk

As you can see, the 32 GB NTFS thumb drive is sdb1.

Now, unmount the NTFS drive with the following command:

$ sudo umount /dev/sdb1

Now, install ntfs-3g with the following command:

$ sudo apt install ntfs-3g

Now, press Y and then press <Enter> to confirm the installation.

ntfs-3g should be installed.

Now, check whether ntfsundelete command is available as follows:

$ whereis ntfsundelete

ntfsundelete is available in the path /sbin/ntfsundelete.

Finding Removed Files:

You can scan for removed files in the drive from where you’ve removed it as follows:

$ sudo ntfsundelete /dev/sdb1 –scan

As you can see, all the removed files are listed in a tabular format. You can find the Inode number of the removed files, how much of each file is recoverable (%age), the last modified date and time of the file, the size of the file (in bytes) and the name of the file.

In the end of the output, ntfsundelete will show you how many files can be recovered. In my case, I can recover 9 files.

You can also specify the scan criteria of the removed files.

If you already know the file size of the file(s) that you’re trying to recover, then you can specify a range of file size as follows:

$ sudo ntfsundelete /dev/sdb1 –size 700k-1M

NOTE: k = kilobyte, M/m = megabyte, g = gigabyte, t = terabyte

As you can see, the removed files in the file size range 700 KB to 1 MB is listed.

You can also tell ntfsundelete to list the files that were last modified since the last 60 months as follows:

$ sudo ntfsundelete /dev/sdb1 –time 60m

NOTE: d = days, w = weeks, m = months and y = years

If you know part of the filename or extension of the removed files, then you can find the removed files as follows:

$ sudo ntfsundelete /dev/sdb1 –match ‘*.jpg’

You can also search for files that has a certain percentage of content (let’s say 90%) you can recover as follows:

$ sudo ntfsundelete /dev/sdb1 –percent 90

Recovering Removed Files:

Let’s say, you want to recover the file with the Inode number 39.

To do that, you can run the following command:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 39

The file should be recovered and saved in the current working directory.

As you can see, the image file is saved in the current working directory.

$ ls -lh

You can also specify a range of Inodes of the files to recover as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 3942

You can also mix specific Inode number, and ranges of Inodes as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –inodes 39,4042,55,5962

By default, ntfsundelete rounds the file size to nearest multiples of 512 bytes (block size). So, the file size of the recovered file will be a little bit larger.

To avoid that, you can use the –truncate option as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –inodes 39

You can also specify an output file name as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –inodes 39 –output test.jpg

As you can see, the recovered image file is saved as test.jpg.

You can also specify a filename pattern to recover all the files that match the pattern altogether as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –match ‘*.jpg’

You can also save the recovered file in a specify directory.

First, create a new directory recovery/ as follows:

Now, recover the files and save them in the recovery/ directory as follows:

$ sudo ntfsundelete /dev/sdb1 –undelete –truncate –match ‘*.jpg’

The files will be recovered.

Now, add read and write permissions to the recovered files as follows:

$ sudo chmod -Rfv a+rw recovery/

Now, you can copy these files to a safe place.

I copied the recovered files to my 32 GB USB thumb drive.

So, that’s how you recover removed files from Windows NTFS drives using Live Ubuntu DVD. Thanks for reading this article.

ONET IDC thành lập vào năm 2012, là công ty chuyên nghiệp tại Việt Nam trong lĩnh vực cung cấp dịch vụ Hosting, VPS, máy chủ vật lý, dịch vụ Firewall Anti DDoS, SSL… Với 10 năm xây dựng và phát triển, ứng dụng nhiều công nghệ hiện đại, ONET IDC đã giúp hàng ngàn khách hàng tin tưởng lựa chọn, mang lại sự ổn định tuyệt đối cho website của khách hàng để thúc đẩy việc kinh doanh đạt được hiệu quả và thành công.
Bài viết liên quan

Install and Get Started with .NET Core on CentOS

.NET Core also known as ASP.NET Core is a high performance, free and open source web framework. It is developed by Microsoft....
29/12/2020

How to download and Play Sid Meier’s Civilization VI on Linux

Introduction to the game Civilization 6 is a modern take on the classic concept introduced in the series of the Age of...
29/12/2020

[CentOS7] Hướng dẫn đổi tên Network interface trong CentOS 7

Bạn sử dụng hay quản trị máy chủ Linux như CentOS, Ubuntu,… thì khi nhắc đến phần cấu hình...
30/12/2020
Bài Viết

Bài Viết Mới Cập Nhật

Huớng dẫn dùng proxy cho ios, iphone 2023
23/09/2023

Cách gắn set proxy cho điện thoại android, oppo, giả lập android, Ldplayer Bằng Proxydroid
20/09/2023

Mua Proxy Socks5 VN Chơi Game Gia Lập Tăng Cường Trải Nghiệm Chơi Game
22/06/2023

Mua Proxy Mỹ, Us Nuôi Tài Khoản Etsy, eBay Tìm Hiểu Về Mua Proxy Mỹ tại Onet.com.vn
22/06/2023

Mua Proxy Game – Giải pháp tuyệt vời cho việc chơi game trên mạng mà không bị giới hạn về vị trí địa lý
03/06/2023