I accidentally removed some files on a NTFS partition

How can I recover them staying inside Linux without rebooting ?

  • Using TestDisk, click through device and type to Advanced.. in partition selection, pay attention to the bottom for Undelete. Then select a different drive to save to. I believe its possible to write a script using fls from TestDisk to recover from a single directory if that is needed or when the TD single selection is tedious.. see this answer here: unix.stackexchange.com/a/390174/346155
    – alchemy
    Apr 30, 2020 at 18:08

1 Answer 1


The Ubuntu Wiki has a lenghty topic on data recovery and, luckily for you, also has a segment on recovering files deleted from a NTFS partition. From that part of the link:


ntfsprogs Install ntfsprogs can recover deleted files from an NTFS file-system. The Windows and LiveCd versions have a very nice intuitive gui but the linux one is probably stronger and does not have a front-end gui at the moment.

Briefly, it has 3 modes

  1. Scan. searches for deleted files and find info about them
  2. Undelete. See below.
  3. Copy.

When undeleting chose which files to undelete and where to undelete them too. By default this appears to be the desktop of the OS you are booted into, whether that is a LiveCd or on a different partition or drive. For a LiveCd or LiveUsb you will need to move them onto Usb-stick or safe partition before rebooting as the desktop gets forgotten on LiveCds unless you are using a Persistent image.

To search

ntfsundelete /dev/sda2

To undelete

ntfsundelete /dev/sda2 -u -i 3689 -o work.doc -d ~/output

This will write all recovered files (in this case word.doc) from/dev/sda2 (be sure to find out the device name of your NTFS partition) in a directory output inside your home directory.

For better information on using ntfsundelete please see the separate page NtfsUndelete, particularly the External Links there.

Besides the part of the wiki it also contains this external link explaining NtfsUndelete with images.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .