How to recover most recently deleted directories on NTFS partition

data-recoveryntfs

In Nautilus under Ubuntu 12.04, I accidentally selected several directories on a partition and deleted them at once (unfortunately, I deleted them by Shift+Delete such that they don't remain in Trash). I haven't written any new data to that partition yet since the deletion. I wonder what ways I can try to recover them?
Note that the partition is NTFS, shared between Windows 7 and Ubuntu 12.04.

Following is different software that I have tried so far.

  1. I have also tried to use Sleuthkit, but I cannot figure out how to
    use it.

    I have been running sudo fls -f ntfs -d -r -p /dev/sda3 >
    ~/deleted_files.txt     for almost a week on my 110GB 96%-used ntfs
    partition. It hasn't finished running yet (don't know when it will), and the file ~/deleted_files.txt is still empty.
    All my work has been stalled since I don't dare to write
    any data to the partition.

    Now I wonder if my usage of sleuthkit is the quickest way to
    identify most recently deleted directories and files in my case?

  2. I installed TestDisk 6.13 via apt-get install, and followed
    http://www.cgsecurity.org/wiki/Undelete_files_from_NTFS_with_TestDisk
    to recover the deleted directories and the files in them. But what
    is shown by TestDisk is not the deleted file/directory names as
    shown in the picture in the link, but files named by inode
    numbers:

    TestDisk 6.13, Data Recovery Utility, November 2011
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
 3 P HPFS - NTFS           9291  38 28 23650 187 25  230686720 [Data]
Deleted files

>inode_13285                           30-Jan-2011 20:55     29427
 inode_13285:Zone.Identifier           30-Jan-2011 20:55        26
 inode_164258                          11-Aug-2011 13:16      2993
 inode_307016                          12-Feb-2011 09:34      1808
 inode_307017                          12-Feb-2011 09:34     10254
 inode_307018                          12-Feb-2011 09:34     13155
 inode_307019                          12-Feb-2011 09:34      7586
 inode_307020                          12-Feb-2011 09:34      7344
 inode_307021                          12-Feb-2011 09:34      6943
 inode_307022                          12-Feb-2011 09:34      6081
 inode_307023                          12-Feb-2011 09:34     24043
 inode_314965                          12-Feb-2011 09:36    112947
 inode_314983                          12-Feb-2011 09:36     23581
 inode_314984                          12-Feb-2011 09:36      8486
 inode_314985                          12-Feb-2011 09:36       158
 inode_314986                          12-Feb-2011 09:36        45
                                                   Next
Use : to select the current file, a to select/deselect all files,
    C to copy the selected files, c to copy the current file, q to quit

    When I hit a and then C to select and copy all the selected
    files, files named inode_xxxxxx will be copied to a directory that
    I specify.

    Also, I don't know the meaning of the date and time for each file
    shown by TestDisk. Does it mean the deletion date and time or last
    update date and time before deletion? (Note the most recent date and
    time shown by TestDisk is 30-Jul-2012 20:53, which is not today when
    the accidental deletion happened.)

    How can I figure out which files are my most recently deleted ones,
    and how can I recover them?

    Can I find out and recover my most recently deleted directories
    instead of just files?

  3. I am also curious to know if these two links to How-to really work?

    In
    http://www.ehow.com/how_5202235_retrieve-deleted-files-linux.html,
    grep -b 'search-text' /dev/partition > file.txt is used to search
    for the deleted files.

    In
    http://www.ehow.com/how_7517984_restore-overwritten-file-linux.html,
    the "Isdel" command is used.

What other software can I try besides TestDisk and Sleuthkit?

Best Answer

Data recovery tools in Linux are very weird and rare in between even more that works on NTFS filesystems. So, if you want a tool that recovers the meta-data of the file and present them, if it's not one of the proposed, ntfsundelete, PhotoRec (Sleuthkit) or TestDisk; I would recommend using Windows-only tools for the task.

Related Question