Undelete

using ntfsundelete

This might save your life one day (or the life of some files you removed bypassing the trash!)

In Linux it's easy (relatively, if you act quickly) to reclaim files that have been wiped from disk -because really they are still there but their names are gone and their inodes have been offered for new files to be stored in their place.

You can "undelete" wiped files from Linux partitions (ext3/ext4) and NTFS -so long as you haven't been using the partition and stored new files over the lost ones. So if something goes wrong you should make a rescue op immediately.

Today I managed to wipe 200Gb of very important data off an external drive. I couldn't believe it had happened. One thing I need to watch out for is when an external drive is not present and an app needs to access it, say for a DVD project, it will create the partition somewhere locally and carry on! Then inserting the external drive makes another entry with a _ after it in /media -it was when I tried removing the phony local version of the drive that it decided to take out loads of real data with it (but left some), and I still can't understand how because I had already unplugged the drive.

Fortunately I had just enough space around on different drives to rescue everything. The deleted files have to be copied to a different partition than the one they were on, and the one recovering from must be unmounted. My drive was NTFS so I'll show how that works.

note: ntfsundelete is installed with the package ntfs-3g

1. get device i.e. sdb1 etc with `lsblk`

2. unmount drive with e.g. `sudo umount /dev/sdb1`

3. list files available for undelete - might need the force option -f

sudo ntfsundelete /dev/sdb1 -f  

(note: you might need to adjust the scroll lines of the Terminal to a few thousand to show long lists)

4. list files of certain type available for undelete

sudo ntfsundelete /dev/sdb1 -m *.MTS -f  

5. list files with something in the filename, available for undelete

sudo ntfsundelete /dev/sdb1 -m something\* -f  

6. combine the above two

sudo ntfsundelete /dev/sdb1 -m something\*MTS -f  

7. undelete with file name

sudo ntfsundelete /dev/sdb1 -u -m 0032.MTS -f  

8. undelete with wildcard extension (will recover ALL files with the ext), to a destination dir with -d switch

sudo ntfsundelete /dev/sdb1 -u -m *.MTS -d /media/VIDEO  

or

sudo ntfsundelete /dev/sdb1 -u -msomething\*.MTS -d /media/VIDEO  

9. undelete with inode range, to a destination dir

sudo ntfsundelete /dev/sdb1 -u -i 7245-7275 -d /media/VIDEO -f  

10. change permissions to user for undeleted files if necessary

sudo chown <username> *.MTS  

Notes

• If you cancel the terminal with the process going, you can restart with exactly the same command and dir location and the process will skip all the files already recovered -it won't write over them, or it can't.
• If you try to split the process between different target directories it will be impossible using a wildcard extension, you'd have to use inode ranges, I'd say. combine them?

Undelete files on ext3/ext4 partitions
http://everydaylht.com/
http://extundelete.sourceforge.net/
Undelete files on NTFS from Linux
http://www.howtogeek.com/.../
http://linux.die.net/man/8/ntfsundelete

using photorec or testdisk

After recovering files from my removable drive (see on the left) I realised that there were some videos yet to be encoded from raw files -and I couldn't get those files after the restore as they were written over -luckily I remembered I hadn't used the SD card much since then, but I had just formatted it.

So in comes photorec, packaged with testdisk, for recovering from FAT format disks -and also from ext3/ext4 and NTFS.

sudo photorec  

Using dd to make an image of a partition first

I had one SDHC card that photorec and testdisk couldn't see any deleted files on, even though I had recently had MTS files on it ..

So I made an image of the SD card with

dd if=/dev/mmcblk0p1 of=/media/FILES/RECOV/disk.img bs=1024M  

remember that "of" stands for output file and it will wipe everything on the location it points to, so be careful!

then

photorec /media/FILES/RECOV/disk.img  

but alas, no files were found either! duh, the card had been formatted.

Then there's extundelete

sudo apt install extundelete  

see heregnutoolbox.com/extundelete/