Recover deleted data from NTFS file system in Ubuntu

I deleted the archive file which contains important images. And i thought it was gone forever, i did not had any backup too. But i was able to restore the deleted archive file using NtfsUndelete.

It was good that i had archived the photos so it was easy to restore. I was using Ubuntu and i deleted the files that was from another drive which is using Ntfs file system. So, i will explain how i was able to recover my files.

Install NtfsUndelete on Ubuntu

We will be installing NtfsUndelete at first(If you have it installed already then skip this step). To install open Terminal(ctrl + alt + t) and enter the following:

sudo apt-get install ntfsprogs

ntfsprogs is the package which contains NtfsUndelete itself and some other useful tools like ntfslevel and ntfsinfo.

Search for your deleted files

First of all enter the following in the terminal

sudo fdisk -l

It will list all the drive in your computer as shown below and note the Device name in which you have deleted the files that are to be recovered. For example my device name will be /dev/sda4.

Now its time to search for the deleted files in the drive. Enter following command in your terminal:

sudo ntfsundelete /dev/sda4 -s -m '*.zip'

In this above code /dev/sda4 is your device name and *.zip is the file extension(it means all the files with .zip extension). If you are searching for .jpg or something then change this file extension.

Note: You must unmount the drive before searching for the deleted files or it will show the error as shown below.

Now it will list all the files that were deleted in that drive as shown below:

Finally recover the deleted files

Now it’s time to recover your deleted files and bring them back. Enter the following in the Terminal:

sudo ntfsundelete /dev/sda4 -u -i 2840

In this above code 2840 is the Inode number which you can find while listing the deleted files above. If you want to recover the .jpg or .png image files and there are many in numbers then you can also recover them by using the following command:

sudo ntfsundelete /dev/sda4 –u –m *.jpg

As mentioned earlier /dev/sda4 is you device name and *.jpg is the extension of the files to be recovered.

When you will get ‘Undeleted Successfully’ message then you can find your files in Home folder.

Here is the screenshot when i recovered .zip file using Inode.

So, i hope you are able to recover your deleted files using NtfsUndelete. I found this tool very useful as it did a lot for me.

For more information visit Ubuntu Wiki Page about NtfsUndelete.