Home / server / Questions / 782475
In Process
Michal_Szulc
Asked: 2016-06-08 05:25:37 +0800 CST

Undelete windows 8 files/directories

  • 772

User accidentally deleted directory with firm data on laptop with Windows 8. I booted Ubuntu liveCD but using :

$sudo fdisk -l

WARNING: GPT (GUID Partition Table) detected on '/dev/sda'! The util fdisk doesn't support GPT. Use GNU Parted.


Disk /dev/sda: 750.2 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders, total 1465149168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x4ad209d2
Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1  1465149167   732574583+  ee  GPT
Partition 1 does not start on physical sector boundary.

and 

$ sudo ntfsundelete /dev/sda1

returned all files with flag F..! and impossible to undelete.

How to get back these files? (history for specified directory and bin on Win8 of course are empty).

windows data-recovery undelete windows-8

1 Answers

  1. User accidentally deleted directory with firm data on laptop with Windows 8

    Since the user deleted a directory but the file system itself is working, you can use Testdisk:

    testdisk /dev/sda

    Follow the on-screen instructions. Basically you will need to:

    • Select the drive
    • Wait for the scan to finish
    • Highlight the affected partition
    • Press P to open the browser
    • Browser the directory tree until you highlight the deleted folder
    • Press C to copy it on some other drive

    If this fails or the file system is severely damaged, check out this answer of mine on AskUbuntu.

    • 0