Every computer user has been there, some more than once – that moment when you realize that you just deleted the wrong file or bunch of files. The recycle bin is useful for these kind of situations where files you delete are seemingly available in the recycle bin and can be restored later. There are a lot of situations where a deleted file doesn’t go to the recycle bin, and this article will discuss how you can recover deleted Windows files with Linux, specifically Ubuntu. The techniques discussed here will work if you dual boot Windows and Linux or if you have a Ubuntu Live CD.
Preparation
First of all, you need to create a folder which would be the destination you recover your files to. This should be in your home directory or in an external storage device. You should then switch your current working directory to this newly created directory. This can be done with the following commands (Note: replace “username” below with your username):
mkdir /home/username/RecoveredFiles cd /home/username/RecoveredFiles
This is important as you MUST NOT recover files into the same filesystem that contains the deleted files. This is because you do not want to overwrite the file you are trying to recover.
Now, you need to know the exact filesystem your deleted files are on. To get a list of all available filesystems, open a terminal and type the following command:
sudo fdisk -l
This command will give you a list of all filesystems and partitions available on your system. From here, you should be able to identify what device your file is on. If you are having troubles identifying the correct device, you can run the following command:
df -h
This will show you a list of all mounted filesystems from which you can find the filesystem device that contains your deleted files. You should then unmount the target filesystem with the command:
sudo umount
Ntfsundelete
Ntfsundelete comes pre-installed on most Linux systems, and it’s even available on Ubuntu’s live CD. To begin, scan the target filesystem for deleted files by running the following command:
sudo ntfsundeleteIf you know the name of the file(s) you want to recover, you can use the -m flag, which returns files that match the given pattern. The following matches both our “SpecialFile1” and “SpecialFile2” deleted files.
sudo ntfsundelete -m *pecial* /dev/sda2
Ntfsundelete nicely formats the results for us and shows the file names and file size, as well as the percentage of the file it can recover. You can find out more about ntfsundelete flags by typing
sudo ntfsundelete -h
To recover a file, we can use the -u flag (undelete) and the -i flag (file inodes). You can specify more than one file inode by separating them with commas:
sudo ntfsundelete -u -i fileinode1, fileinode2
Testdisk
This is a very powerful tool, and can do some serious damage to your system if it’s not used correctly. It is advisable to NEVER use this tool if you are feeling sleepy or drowsy. All the rules applicable to operating heavy machinery apply here.
In addition to recovering deleted files, testdisk can fix your partition table, recover deleted partitions, rebuild windows (NTFS and FAT) boot sectors, and copy files from deleted FAT, exFAT, NTFS and Ext2/Ext3/Ext4 partitions.
Testdisk can be installed in Ubuntu by running the following in a terminal:
sudo apt-get install testdisk
Run the program interactively by typing
sudo testdiskThen select the option to create a new log file.
Choose the hard drive containing your files
Testdisk detects the partition type on the hard drive and gives a hint to guide you on what choice to make.
Note: please be sure to choose the hinted partition type unless you are absolutely certain that the hint is wrong.
Select “[Advanced] Filesystem Utils”. Ignore all the other options.
Use the up/down arrows to select the target partition, and use right/left to select undelete at the bottom of the terminal.
Navigate to the target directory containing the deleted files. Deleted files are shown with red text. Use the up/down arrow to select the target file.
Press “c” to copy file. Testdisk will ask where you want to save the file. Press “y” to undelete and save the file at the target destination. A helpful color-coded message will alert you to success or failure.
Conclusion
The recovered files are owned by the root user. To transfer ownership of the file to your user, run the following command, substituting your username and recovered files:
sudo chown username SpecialFile1.jpg SpecialFile2.jpg
The best way to ensure critical files are accessible after accidental deletion is to have a backup. These tools will help you recover deleted Windows files with Linux. More information can be found online for ntfsundelete and testdisk.
Our latest tutorials delivered straight to your inbox
