How to Undelete a Removed File on a NTFS File System

This is the instruction to recover a deleted file on a NTFS partition mounted on Linux. For windows, there are commerical software you can use to do the undelete. But if you have a Linux partition installed on your computer, you can recover/undelete the file in the NTFS partition under Linux for free.

To recover a deleted file on a NTFS partition use ntfsundelete (yum install ntfsprogs). For example, to recover abc.xls. First check the file deleted within a day (assume you deleted the file today, then recover the file with inode specified(in this case 106).

# ntfsundelete /dev/sda5 -t 1d
Inode    Flags  %age  Date           Size  Filename
---------------------------------------------------------------
106      FN..   100%  2008-10-14     14848  
4477     FN..   100%  2008-10-14     14848  

Files with potentially recoverable content: 2

# ntfsundelete /dev/sda5 -u -i 106 -o abc.xls
Inode    Flags  %age  Date            Size  Filename
---------------------------------------------------------------
106      FN..     0%  2008-10-14     14848  

Undeleted '(null)' successfully.

Also see instruction for undeleting a file on an ext3 file system.