I am in a serious problem here.

I am running dual boot windows 10 and Ubuntu. The last time I accessed Windows was 3 weeks ago and I'm fairly sure that it wasn't in the middle of updates or anything when I started Ubuntu again. Furthermore, I do not use hibernate at all.

I have a shared drive between my Windows 10 and ubuntu. I logged in to Windows this morning and tried to access the shared drive. When I tried to access new folders in the drive that did not exist before when I was logged in to Windows, Windows complained something about the files being corrupt and I noticed that those new files disappeared.

What's worse is when I logged back in to Ubuntu, all those new files were gone.

If it helps my case, I would like to add that the last time I accessed Windows, when I logged back in to Ubuntu, Ubuntu complained that it couldn't mount the shared drive and so I followed some instructions that you had to type on the terminal (sorry I don't remember it at all).

I have 2 important questions now:

1) How can I prevent this from happening in the future?

2) How can I recover those files that I lost?

I sincerely appreciate help here. Those files are important for my research.

Thanks and I hope to hear your suggestions soon.


Thanks for the responses I've been getting! I have tried photorec and I'm now sorting through my files. If it fails, I'll try rkeating's suggestion below.

I will now back-up my files but I fear that that will still not solve the problem even after disabling all the windows updates, etc. If I did not access the shared drive from windows, nothing would have happened. It was when I clicked on a relatively recent folder that things went wrong. After doing so, my old files were still accessible from my shared drive. How do I ensure that I will be able to access files on the shared drive from Windows without any problems in the future? I appreciate your suggestions a lot! Thanks!

  • 2
    " How can I prevent this from happening in the future?" 99% chance this is a Windows problem. "Those files are important for my research." Restore a backup. – Rinzwind Mar 20 '18 at 12:31
  • 1
    Hi Rinzwind, how would I go about ensuring that Windows won't screw it up next time? The problem is, I don't back up my files. I will do so from now on. But any suggestions how to recover them from Ubuntu? Those are just text/pdf files and don't occupy a lot of space – user1237300 Mar 20 '18 at 12:34
  • 1
    Download and run testdisk which will hopefully rebuild the lost partition. – WinEunuuchs2Unix Mar 20 '18 at 12:43
  • I will definitely do that... Is there anything I need to do/disable in windows first before trying to restore the files in ubuntu? Should I just disable all windows updates? What else should I disable? – user1237300 Mar 20 '18 at 12:46
  • 1
    Make sure fast boot and hibernation are off in windows – Panther Mar 20 '18 at 14:47

When Windows deletes files, it puts them in the trash. I am guessing you looked in Windows trash and didn't find them. You could search for them from within Ubuntu with the following commands. Since you say the drive is shared I am assuming an NTFS file system. If it is not, these command will not work.

Run this command and save the output to a file:

sudo ntfsundelete /dev/sdxx (where sdxx is the windows drive/partition you want to undelete from such as sda1.) This produces a list of deleted files. The list may be very long.

Read through the list to select the id (or ids ex: 123-176) of the files you want to undelete. Use the command:

ntfsundelete /dev/sdxx -u -i id# (change xx to your drive/partition and id# to the ID of the file to undelete)

Here is an example for sda1 using a range of IDs to undelete:

ntfsundelete /dev/sda1 -u -i 4775-4786

  • Is it possible to save the output to a text file, since you said the list may be very long? – user1237300 Mar 20 '18 at 13:08
  • I tried it but it says: Access is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command. You can use force option to avoid this check, but this is not recommended and may lead to data corruption. – user1237300 Mar 20 '18 at 13:10
  • Unmount the volume you are running the command against. Easiest way to do that is open your file manager and click on the icon to unmount , them rerun your ntfsundelete command. – rkeating Mar 20 '18 at 13:45
  • I see. I'm currently running photorec now. I'll try your suggestion once photorec is done. I want to be careful this time. If I unmount it, how can I mount the volume again? – user1237300 Mar 20 '18 at 13:51
  • I missed your first reply. To save the output to a file, just redirect it. sudo ntfsundelete /dev/sdxx > MyOutputFile To remount the file system, just click on it in file manager and it will remount. – rkeating Mar 20 '18 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.