{"id":853,"date":"2016-11-10T22:10:14","date_gmt":"2016-11-10T19:10:14","guid":{"rendered":"https:\/\/oss-it.su\/?p=853"},"modified":"2022-01-06T01:56:50","modified_gmt":"2022-01-05T22:56:50","slug":"%d0%b2%d0%be%d1%81%d1%81%d1%82%d0%b0%d0%bd%d0%be%d0%b2%d0%bb%d0%b5%d0%bd%d0%b8%d0%b5-%d1%83%d0%b4%d0%b0%d0%bb%d0%b5%d0%bd%d0%bd%d1%8b%d1%85-%d0%b2-windows-%d1%84%d0%b0%d0%b9%d0%bb%d0%be%d0%b2-%d1%81","status":"publish","type":"post","link":"https:\/\/oss-it.su\/en\/853","title":{"rendered":"Recover deleted files on an Windows partition with a Linux Live CD"},"content":{"rendered":"

If you find yourself in a situation where you need to restore deleted files (formerly this procedure called ‘unerase’) from a Windows ntfs partition, but are unable to boot from it, the simplest solution is to use a Linux LiveCD. This will require the ntfsundelete<\/code> utility which is bundled with most LiveCDs.<\/p>\n

The most popular LiveCD for this task today is Ubuntu. We recommend using its lightweight variant Lubuntu, which you can always freely download here<\/a>.<\/p>\n

Burn the LiveCD iso image to an USB stick, boot from it, open a terminal (CTRL+ALT+T) and type the command:<\/p>\n

sudo fdisk -l<\/code><\/p>\n

This will show you the actual name of the partition you want to recover your deleted files from. Alternatively, you can use the graphical gparted<\/code> utility, which you can load with the command:<\/p>\n

sudo gparted<\/code><\/p>\n

Let’s say the partition you want to recover files from is \/dev\/sda1 (formerly “drive C” in Windows). By entering the command:<\/p>\n

sudo ntfsundelete \/dev\/sda1<\/code><\/p>\n

– you will get a list of deleted files available for recovery.<\/p>\n

Navigate to the folder where you want to restore the files using the cd<\/code> command. And you’re ready to:<\/p>\n

sudo ntfsundelete \/dev\/sda1 \u2013u \u2013m *.jpg<\/code><\/p>\n

– will restore all deleted files with jpg extension.<\/p>\n

sudo ntfsundelete \/dev\/sda1 \u2013u \u2013m Inode<\/code><\/p>\n

– where Inode<\/code> is the numeric value of the individual file you want to recover (these values appear in the first column of the list of files available for recovery).<\/p>\n

You can change the ownership of recovered files by using the chown<\/code> command. So, for example, you can change the owner of all files in the directory to the user lubuntu:<\/p>\n

sudo chown lubuntu *<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

How to recover deleted files on an NTFS partition with any Linux Live CD.<\/p>\n","protected":false},"author":1,"featured_media":856,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-853","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-system"],"_links":{"self":[{"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/posts\/853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/comments?post=853"}],"version-history":[{"count":4,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/posts\/853\/revisions"}],"predecessor-version":[{"id":1105,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/posts\/853\/revisions\/1105"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/media\/856"}],"wp:attachment":[{"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/media?parent=853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/categories?post=853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/oss-it.su\/en\/wp-json\/wp\/v2\/tags?post=853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}