Possible to undelete?

[Muse]

I always highlight files and press Shift+Delete, which deletes without putting files in my recycle bin. On this occasion I rean a .BAT file that deleted the files in a certain directory, which also doesn't involve the Recycle Bin. Is there a way I can retrieve thos files? It's not huge, but I want to. Thanks.

 

[Nothinman]

It's possible, but the more you use the drive the less of a chance you have of it working. The first thing I would probably do is boot a Linux LiveCD, install ntfsprogs (Ubuntu LiveCDs let you install things to the system running in memory) and try ntfsundelete from there.

 

[Muse]

Originally posted by: Nothinman
It's possible, but the more you use the drive the less of a chance you have of it working. The first thing I would probably do is boot a Linux LiveCD, install ntfsprogs (Ubuntu LiveCDs let you install things to the system running in memory) and try ntfsundelete from there.

I don't think I've used the drive yet. Where can I get a Linux LiveCD? Download?

 

[Nothinman]

I don't think I've used the drive yet. Where can I get a Linux LiveCD? Download?

If it's your system drive you have, if it's not then as long as you haven't done anything with the files on it you haven't used it. Although that's not guarantee that the files will be recoverable it greatly increases the chance.

The install disc for Ubuntu is a LiveCD, just start here: http://www.ubuntu.com/getubuntu/download but if you've never used any Linux before it might be a bit of a PITA.

 

[Muse]

Originally posted by: Nothinman

I don't think I've used the drive yet. Where can I get a Linux LiveCD? Download?

If it's your system drive you have, if it's not then as long as you haven't done anything with the files on it you haven't used it. Although that's not guarantee that the files will be recoverable it greatly increases the chance.

The install disc for Ubuntu is a LiveCD, just start here: http://www.ubuntu.com/getubuntu/download but if you've never used any Linux before it might be a bit of a PITA.

Never used Linux, but I'm willing to try. Is it possible I'll be able to figure it out? The drive is one I use mostly for HDTV recordings, real big, not a system drive, a 500 GB SATA drive. I don't believe I've used it at all since the delete, which just deleted probably a few hundred files from one folder. I did a defrag just previous to making the recordings, it so happens, which shouldn't hurt. It was an HD recording of the Super Bowl, and I ran the .BAT file by force of habit. I really didn't mean to delete the files. I had it in mind to save a few seconds of it but now have the idea I'd like to watch the game again! Thanks for the help!

Edit: I was going to download 5.10 on this page. Does that look good?

 

[Nothinman]

Basically what you'll have to do is boot up the LiveCD, run System->Administration->Synaptic Package Manager. From there click Settings->Repositories and check "Community maintained...(universe)". When you close that it should prompt you to reload the package list, if not click Reload. Search for and install ntfsprogs. once that's installed hit Alt+F2 to bring up the run dialog and type 'gnome-terminal', once the terminal starts run 'sudo -s' and it should give you a root shell. From there you can run ntfsundelete on the drive which will probably be /dev/sda1 or /dev/sdb1, depending on how many drives you have.

Edit: I was going to download 5.10 on this page. Does that look good?

No, that's too old. 7.10 is what you want. The version numbers are basically year.month so 5.10 was released in October of 2005, 4 major releases ago.

 

[Muse]

Originally posted by: Nothinman
Basically what you'll have to do is boot up the LiveCD, run System->Administration->Synaptic Package Manager. From there click Settings->Repositories and check "Community maintained...(universe)". When you close that it should prompt you to reload the package list, if not click Reload. Search for and install ntfsprogs. once that's installed hit Alt+F2 to bring up the run dialog and type 'gnome-terminal', once the terminal starts run 'sudo -s' and it should give you a root shell. From there you can run ntfsundelete on the drive which will probably be /dev/sda1 or /dev/sdb1, depending on how many drives you have.

Edit: I was going to download 5.10 on this page. Does that look good?

No, that's too old. 7.10 is what you want. The version numbers are basically year.month so 5.10 was released in October of 2005, 4 major releases ago.

Thanks! I just cancelled my 5.10 download and will start 7.10. The download was going very slowly (ISO files, about 2% after almost 10 minutes).

My drives look like this:

C: boot XP Pro IDE
D: NTFS partition of same drive
E: NTFS partition of same drive

---> F: 500 GB SATA Drive, one NTFS partition (this is the drive with the files)

G: 200 GB drive NTFS IDE

H: 4th drive 1st partition, FAT32 IDE drive
I: 4th drive 2nd partition, NTFS
- - - -

Edit: This DL is going a lot faster. I'm saving it to disk. It's from the University of Utah mirror.

Edit2: It's at about 2% after 2 minutes. I'm going to leave for a while and come back in 1.5-2 hours...

 

[Nothinman]

Ok if I had to guess I'd say it's going to show up as /dev/sdb1 but there's really no way to tell until you boot the disc.

 

[Muse]

Originally posted by: Nothinman
Ok if I had to guess I'd say it's going to show up as /dev/sdb1 but there's really no way to tell until you boot the disc.

So, that would be the drive identification, I suppose. Then will I be at some kind of a command prompt? I know a fair amount of DOS, but this isn't DOS. Well, I just got back and will now look at the download and proceed to make the LiveCD write...

This has the makings of an adventure, and I like that. I'm in no hurry to use the drive. I have enough disk space on other drives to get me by right now. Is it possible to make the entire drive Read Only in XP Pro, meantime, just to make sure I don't write to the drive? Looks like I could under the Security tab of the properties for the drive. I don't know if I should bother doing that. If I do, would that prevent Ubuntu from dealing with the drive unless I change that stuff in XP Pro Security?

 

[Nothinman]

So, that would be the drive identification, I suppose.

Yea, in Linux all devices reside in the /dev directory. For drives they're either called /dev/hd* for the old-style IDE driver or /dev/sd* for anything that uses the SCSI subsystem (i.e. SATA, new style PATA, USB, firewire, etc). I believe that release of Ubuntu uses the new-style (libata) IDE drivers for both PATA and SATA so all of your drives should be /dev/sda, /dev/sdb, etc in the order they're detected. And partitions are numbered no matter what so partition one on the first drive will be /dev/sda1, the first partition on the second drive /dev/sdb1, etc.

Then will I be at some kind of a command prompt?

Well Ubuntu should boot straight into Gnome as long as it can detect all of your hardware properly. But at the point where I have you run 'sudo -s' you'll be at a root prompt, you need to do this because ntfsundelete is a CLI only program.

Is it possible to make the entire drive Read Only in XP Pro, meantime, just to make sure I don't write to the drive? Looks like I could under the Security tab of the properties for the drive. I don't know if I should bother doing that. If I do, would that prevent Ubuntu from dealing with the drive unless I change that stuff in XP Pro Security?

Windows will do a little writing to the drive in the MFT on mount no matter what, so no I don't think there's a way to mark it 100% read-only. No, Ubuntu will just ignore the NTFS ACLs so anything you do there won't affect your ability to recover the files or anything else in Linux. The only real concern would be if the files were encrypted using EFS in XP.

 

[Nothinman]

Also, do you have some place that's not NTFS to recover the files? You can get write access to NTFS filesystems by installing ntfs-3g in the LiveCD as well but I've never used it so I can't vouch for it.

 

[Muse]

Mmm, well, I booted to the CD but seem to have a graphics problem? I get the first screen where I choose what I want to do, the first option being to run or install Ubuntu. There are 1/2 a dozen other things I can do including hitting F6 for "other options." The default is option 1, being run or install and the timeout is 30 seconds. I went with option 1 and after a bit, I get an alternating image, the first being light grey, the second being a light grey with around 100 vertical lines. The images change from one to the other every 1/2 second or so. After a few seconds of that it changes and I get a screen that really looks like a problem with graphics and that changes pretty quick to a screen where it alternates between red and the vertical stripe thing (about 3x/second) with around 10 rectangles, seemingly randomly placed on the screen. That keeps going indefinitely.

I downloaded the version for AMD 64, because I'm running:

MB: MSI K8N Neo-FSR/ V V2.0
CPU: AMD Athlon Venice core 3200+ 2.2 GHz

That CPU is, I'm 99% positive an AMD Athlon 64.

The graphics card is:

BFG geforce 6600 GT OC AGP

There appears to be a choice to run Ubuntu with a different graphics configuration, maybe something equivalent to VGA in Windows. Should I try that?

 

[Muse]

Originally posted by: Nothinman
Also, do you have some place that's not NTFS to recover the files? You can get write access to NTFS filesystems by installing ntfs-3g in the LiveCD as well but I've never used it so I can't vouch for it.

Everything is NTFS except for a 40 GB Fat32 partition, which is half full. The files deleted total around 70 GB, I figure! So, I guess you're saying that I can't just undelete the files but have to write them to a different partition? Well, I do have an unused 80 GB hard drive on my shelf. I guess I could use that for the purpose one way or another. I could reformat it to any file system, presumably.

I also have another PC right next to this one, if that would help somehow. Also, a firewire card.

As well, I have a 500 GB USB connected SATA HD. It's one big NTFS partition, 2/3 empty.

 

[Nothinman]

There appears to be a choice to run Ubuntu with a different graphics configuration, maybe something equivalent to VGA in Windows. Should I try that?

Yea, there should be a "safe mode" option as the second choice on the boot screen. Try that.

There are 1/2 a dozen other things I can do including hitting F6 for "other options."

Hitting F6 just lets you edit the kernel boot parameters, but if you do that you can erase the "quiet splash" part of the parameters and you'll get to see the kernel and init scripts output. That might give you an idea what's going wrong or if it's just an interaction problem with splash and Xorg might fix it too.

So, I guess you're saying that I can't just undelete the files but have to write them to a different partition?

Actually I'm not sure, originally I thought so but looking at the man page again looks to say otherwise.

I also have another PC right next to this one, if that would help somehow. Also, a firewire card.

If they're both on the network that'll work fine, just share a directory and mount it as CIFS in the LiveCD.

 

[Muse]

Originally posted by: Nothinman

There appears to be a choice to run Ubuntu with a different graphics configuration, maybe something equivalent to VGA in Windows. Should I try that?

Yea, there should be a "safe mode" option as the second choice on the boot screen. Try that.

There are 1/2 a dozen other things I can do including hitting F6 for "other options."

Hitting F6 just lets you edit the kernel boot parameters, but if you do that you can erase the "quiet splash" part of the parameters and you'll get to see the kernel and init scripts output. That might give you an idea what's going wrong or if it's just an interaction problem with splash and Xorg might fix it too.

So, I guess you're saying that I can't just undelete the files but have to write them to a different partition?

Actually I'm not sure, originally I thought so but looking at the man page again looks to say otherwise.

I also have another PC right next to this one, if that would help somehow. Also, a firewire card.

If they're both on the network that'll work fine, just share a directory and mount it as CIFS in the LiveCD.

I'll have to get back to this probably sometime Wednesday. Tomorrow is a full day and tonight I'm already too tired to tackle this. Thanks for the help. I'll give it another try sometime Wednesday. Meantime, I've configured my programs to stay off of drive F:.

The machines are both connected by ethernet to a wireless router (use my laptop with that), although I don't presently have them configured to see each other in Windows. Don't often use the 2nd machine, mostly it's there for troubleshooting problems or for Internet access when the other machine doesn't have it for whatever reason. I presume, though, that the lack of Windows network configuration of the two machines will have no impact on being able to share a directory using LiveCD, should I want to do that.

So, what is the m.o. here? There is a utility in Linux to undelete NTFS based files?

 

[JustaGeek]

Have you guys tried the Free Undelete...?

http://www.officerecovery.com/freeundelete/

 

[Muse]

Originally posted by: JustaGeek
Have you guys tried the Free Undelete...?

http://www.officerecovery.com/freeundelete/

Never heard of it. Thanks! I'll check it out...

 

[Muse]

So, I downloaded and installed and am running freeundelete, and the files are seen and I selected all 1500+ files and hit the undelete button. Now, a dialog comes up for each of the files and says that such and such a file has been recovered with an OK button. I hit the OK button, and the dialog comes up for the next such file, etc. I don't see the files yet in the folder, so I just have to hope they all appear when I've hit OK for the 1500+th time!!! Kinda weird, but it looks like it's working, I'll see...


... I'm up to 300 now... It's gonna take over an hour.

 

[Muse]

Oh oh, now instead of saying that the file was recovered, it says "Not enought (sic) space for recovering the file. Please select another disk" [OK]

Don't know what this means. The dialogs keep popping up and it looks like I'm going to have to hit the cancel button and all work lost. Argh. I'm up to around 460 files of the 1533 files I need to recover. There's over 300 GB free on the drive, and the total of the 1533 files is around 70 GB, so it can't be that. The instructions for the utility are to install it on other than the drive you are working on. Don't know what's at play here. Maybe it uses the system drive and needs at least that much free space there. Or, the install drive, which for me is another partition (and drive) altogether (38 GB free on it right now). I guess I'll look and see if I can change the configuration of the program and run it again. I can contact them for support but they say they don't guarantee support to non-paying customers. Commercial use is to pay $70 for the program. Sigh...

Doesn't look like I can cancel the program, either. Gonna have to hit Control+alt+delete and stop the program using Windows... The windows keep popping up and they are modal (the cancel button isn't accessible).

 

[JustaGeek]

I haven't played with it enough to help you more - sorry!

But it sees the files, and as long as they are not corrupted, only deleted (meaning, the first letter of the file name is "erased"), you should be able to recover them.

Good luck!

 

[Muse]

I see what the problem is. The default destination folder was the root of my C: drive! All is not lost!!

 

[Muse]

Originally posted by: JustaGeek
I haven't played with it enough to help you more - sorry!

But it sees the files, and as long as they are not corrupted, only deleted (meaning, the first letter of the file name is "erased"), you should be able to recover them.

Good luck!

Yes, it's working! I have plenty of HD space. It's just a matter of recovering them to a different location, something I didn't realize. I thought it would just undelete the files, and figured it would do it in a second once I'd selected all the files and hit the Undelete button. It's not as simple as that. I think I'm going to have to hit the Enter button around 1200 more times, though. Anyway, I'll have all my data.

 

[JustaGeek]

Great! :thumbsup:

 

[Muse]

Originally posted by: JustaGeek
Great! :thumbsup:

Yup, I have the whole time shift now and will use a freeware called HDTVtoMPEG2 to convert around 1000 of them into a single source file. Thanks for that tip!