0

I have already seen a lot of answers about recovering permanently deleted files from ext4, ntfs etc but i have a problem that when i use testdisk/photorec i select the drive from which the files are to be recovered and it recoveres everything from the available sectors to the destination. What i want is to filter the recovered files like i just want those files to be recovered that were deleted today or the files that were deleted from a particular directory like in my ntfs disk others/imp/this folder. Is there any way to filter what to be recovered like this.

3
  • The utilities you mention recover the files by grabbing the data (from the inodes that contained the data). The dates, directories etc. are from the the file-system entries where the delete was performed, so that metadata was gone when file was deleted; thus is not used by the recovery tools (no data is there to use). To my knowledge it's not possible as that was deleted.
    – guiverc
    Sep 30, 2018 at 8:25
  • @guiverc can any utility other then mentioned do this? Sep 30, 2018 at 8:56
  • the data you want to use is data actually deleted when you rm a file; it's gone. If it still existed the file would still be visible. In some systems, (eg. prehistoric FAT) the first character can be replaced by a 'space' (maybe 0xA0? when file is deleted; allowing all characters to be restored except that first character, but that's file-system specific, applying to a 8.3 character filename people today wouldn't likely accept in a modern file-systems. I'm only explaining why no such utilities exist. I'd suggest creating a script, comparing data from backups to restored-data...
    – guiverc
    Sep 30, 2018 at 9:16

0

You must log in to answer this question.

Browse other questions tagged .