Home / ubuntu / Questions / 604991
In Process
UTF-8
Asked: 2015-04-04 10:20:14 +0800 CST

Recover file name from old NTFS partition

  • 772

I have an old NTFS partition from Windows XP (system partition) where I once stored a certain file. I know about where its stored and furthermore guess the file ending. Plus, I don't need the content of the file, the file name is perfectly sufficient.

The reason why I'm asking this, of course, is that this file is deleted. I tried recovery tools but it didn't help. Testdisk comes up with a lot files because it's a system partition and its impossible to read all the names.

It would be great to have a list of the name of as many deleted files as possible because I then could find it with ease. But I don't see a good way to do this with testdisk except for maybe cloning the output, placing a stone on the keyboard to scroll trough all the results and then to come back after a week to proceed.

To you know how I can get such a list? Or a list of as many deleted files that last were in a certain directory?

Edit: I'm currently downloading Ubuntu 12.04 to check out the software mentioned in the comments below since 12.04 is the newest version of Ubuntu with this package. I thought that I had a machine running Ubuntu 12.04 but as it turned out it's Ubuntu 12.10.

Edit 2: I guess that I probably should mention here, too, that the proposed solution in the question this question allegedly is a duplicate of, didn't work. I now tried it and got errors: pastebin.com/JtTnPCD9 But I also got a long list of deleted files, none of which even match the file extension candidates. I also know another part of the file name but it also doesn't occur even once, so I can rule out that the file I'm searching for is in there.

Edit 3: I'm searching for a video. Either the name of the file or its content is okay. I don't need both.

data-recovery

1 Answers

  1. If testdisk couldn't see the file, that means that the filesystem entry containing the references to it has been overwritten already.

    As for any overwritten file, there's no way to recover such overwritten entry (i.e. there's no way to recover the filename).

    But if recovering the file's content is enough, you can try to use photorec, which will read the device block by block looking for known file structure patterns (also note that per its scope photorec will recover any file of the same type of the missing file's type present on the drive); assuming that your file had a .ext extension:

    1. Open a Terminal by hitting Ctrl+Alt+t
    2. Install photorec: sudo apt-get install testdisk
    3. Run photorec: sudo photorec
    4. Select the drive containing the partition from which the file was deleted and choose Proceed
    5. Choose File Opt
    6. Hit s to untick all the entries in the list. Find the entry containing the .ext extension, hit Spacebar and then hit Enter
    7. Select the partition from which the file was deleted and choose Search
    8. Select the partition type and hit Enter
    9. Navigate to the directory in which you wish to recover the deleted file(s) using Left / Right and hit C
    10. Wait, this might take a while based on your drive type (HDD/SSD) and on your drive size
    11. Browse to the folder in which you chose to recover the file(s) and see if your file was recovered
    • 5