Recover windows data with linux

ntfs-3g should be installed.

Now, check whether ntfsundelete command is available as follows:

ntfsundelete is available in the path /sbin/ntfsundelete.

Finding Removed Files:

You can scan for removed files in the drive from where you’ve removed it as follows:

As you can see, all the removed files are listed in a tabular format. You can find the Inode number of the removed files, how much of each file is recoverable (%age), the last modified date and time of the file, the size of the file (in bytes) and the name of the file.

In the end of the output, ntfsundelete will show you how many files can be recovered. In my case, I can recover 9 files.

You can also specify the scan criteria of the removed files.

If you already know the file size of the file(s) that you’re trying to recover, then you can specify a range of file size as follows:

NOTE: k = kilobyte, M/m = megabyte, g = gigabyte, t = terabyte

As you can see, the removed files in the file size range 700 KB to 1 MB is listed.

You can also tell ntfsundelete to list the files that were last modified since the last 60 months as follows:

NOTE: d = days, w = weeks, m = months and y = years

If you know part of the filename or extension of the removed files, then you can find the removed files as follows:

You can also search for files that has a certain percentage of content (let’s say 90%) you can recover as follows:

Recovering Removed Files:

Let’s say, you want to recover the file with the Inode number 39.

To do that, you can run the following command:

The file should be recovered and saved in the current working directory.

As you can see, the image file is saved in the current working directory.

You can also specify a range of Inodes of the files to recover as follows:

You can also mix specific Inode number, and ranges of Inodes as follows:

By default, ntfsundelete rounds the file size to nearest multiples of 512 bytes (block size). So, the file size of the recovered file will be a little bit larger.

To avoid that, you can use the –truncate option as follows:

You can also specify an output file name as follows:

As you can see, the recovered image file is saved as test.jpg.

You can also specify a filename pattern to recover all the files that match the pattern altogether as follows:

You can also save the recovered file in a specify directory.

First, create a new directory recovery/ as follows:

Now, recover the files and save them in the recovery/ directory as follows:

The files will be recovered.

Now, add read and write permissions to the recovered files as follows:

Now, you can copy these files to a safe place.

I copied the recovered files to my 32 GB USB thumb drive.

So, that’s how you recover removed files from Windows NTFS drives using Live Ubuntu DVD. Thanks for reading this article.

About the author

Shahriar Shovon

Freelancer & Linux System Administrator. Also loves Web API development with Node.js and JavaScript. I was born in Bangladesh. I am currently studying Electronics and Communication Engineering at Khulna University of Engineering & Technology (KUET), one of the demanding public engineering universities of Bangladesh.

Источник

Performing Windows and Word Recovery, Linux Style

In the event of a hardware failure or disc media corruption, data can be lost, leaving you high and dry. Recovery might be possible, but this can often involve following an exact set of steps in a specific time period, something that may not be possible for you to achieve.

Therefore you might be looking at some alternative ways to recover your data. You might even consider the rather outlandish sounding Word document recovery in Linux.

Thanks to the open source platform employing a different file system, Linux can be used to recover lost Windows files, including .DOC format files from Microsoft Word.

Using Linux for Windows File Recovery

Various methods are available for recovering Windows data in Linux. These typically require the use of a “Live CD” which loads the Linux OS of your choice into your computer’s RAM. Whether your PC has suffered from a severe crash or your Word document is corrupt and needs recovering in some way, Linux can be used in the “Live” form to either read or recover lost documents or to apply some file system fixes to aid in the recovery of data.

Trinity Rescue Kit

Using the freeware Trinity Rescue Kit LIVE Linux distribution (which can be run from CD or USB stick) you can take advantage of a series of tools that can be used to apply recovery and repair operations on a Windows PC or laptop.

• recovery and undeletion of files
• recovery of lost disk partitions
• evacuation data from “dying” hard disk drives

This is all made possible via an easy to use text menu interface. Trinity Rescue Kit – also known as TRK – is one of the top recovery tools for PC engineers “in the know” and can be used to save a lot of time hauling failed PCs back to the lab to repair.

Windows and Word Recovery with Linux TRK

To take advantage of TRK, first visit the website above and download the ISO. Next, burn it to disc – you’re ready to use TRK!

Usage is via the optical drive on your target computer; if you’re planning on effecting recovery on a notebook with no optical drive then you will need to make sure that an external device is available, or you could use the ISO on a bootable USB Flash Disk.

With the disc inserted and Trinity Rescue Kit running, use the Easy menu > Backup and restore utilities option to begin scanning your hard disk drive for Windows and Word files that you want to recover. This is done with the ntfsundelete utility that is packaged in TRK, and can be used to recover files and automatically apply new filenames to them as well as saving recovered data to a new location.

References

Источник