2

I have an old NTFS partition from Windows XP (system partition) where I once stored a certain file. I know about where its stored and furthermore guess the file ending. Plus, I don't need the content of the file, the file name is perfectly sufficient.

The reason why I'm asking this, of course, is that this file is deleted. I tried recovery tools but it didn't help. Testdisk comes up with a lot files because it's a system partition and its impossible to read all the names.

It would be great to have a list of the name of as many deleted files as possible because I then could find it with ease. But I don't see a good way to do this with testdisk except for maybe cloning the output, placing a stone on the keyboard to scroll trough all the results and then to come back after a week to proceed.

To you know how I can get such a list? Or a list of as many deleted files that last were in a certain directory?

Edit: I'm currently downloading Ubuntu 12.04 to check out the software mentioned in the comments below since 12.04 is the newest version of Ubuntu with this package. I thought that I had a machine running Ubuntu 12.04 but as it turned out it's Ubuntu 12.10.

Edit 2: I guess that I probably should mention here, too, that the proposed solution in the question this question allegedly is a duplicate of, didn't work. I now tried it and got errors: pastebin.com/JtTnPCD9 But I also got a long list of deleted files, none of which even match the file extension candidates. I also know another part of the file name but it also doesn't occur even once, so I can rule out that the file I'm searching for is in there.

Edit 3: I'm searching for a video. Either the name of the file or its content is okay. I don't need both.

19
  • possible duplicate of Recover accidentally removed files on NTFS partition Apr 3, 2015 at 18:33
  • 1
    @DavidFoerster, no, it's not. I actually ruled this out in my problem description. There is no need for data recovery which I clearly stated. The question you link to only contains a mention of testdisk, another software which doesn't help and a link to another question the answer of which is testdisk. I actually said in my question that I know about testdisk and have used it to try a recovery but it is impractical to use because I virtually had to scroll through about 1 million file names.
    – UTF-8
    Apr 3, 2015 at 18:38
  • I found a better duplicate, which doesn't even mention Testdisk. Refresh this page in your browser and see the new link in my first comment. Apr 3, 2015 at 18:39
  • The duplicates you talk about are the very same question. I'm currently at a very slow internet connection, so I couldn't do it yesterday because I had to wait for the download of Ubuntu 12.04 to finish. I now tried it and got errors: pastebin.com/JtTnPCD9 But I also got a long list of deleted files, none of which even match the file extension candidates. I also know another part of the file name but it also doesn't occur even once, so I can rule out that the file I'm searching for is in there.
    – UTF-8
    Apr 4, 2015 at 11:44
  • Wasn't there a hint for a Windows program to try, yesterday? I have a Windows installation which I could use to try this program. I didn't try this yesterday because I was making a copy of the partition with the deleted file and was waiting for it to end until I would make another copy on a not encrypted medium because I don't want to enter passwords for strong encryption on a Windows pc. However, now the answer with the proposed program is gone.
    – UTF-8
    Apr 4, 2015 at 13:48

1 Answer 1

5
+100

If testdisk couldn't see the file, that means that the filesystem entry containing the references to it has been overwritten already.

As for any overwritten file, there's no way to recover such overwritten entry (i.e. there's no way to recover the filename).

But if recovering the file's content is enough, you can try to use photorec, which will read the device block by block looking for known file structure patterns (also note that per its scope photorec will recover any file of the same type of the missing file's type present on the drive); assuming that your file had a .ext extension:

  1. Open a Terminal by hitting Ctrl+Alt+t
  2. Install photorec: sudo apt-get install testdisk
  3. Run photorec: sudo photorec
  4. Select the drive containing the partition from which the file was deleted and choose Proceed
  5. Choose File Opt
  6. Hit s to untick all the entries in the list. Find the entry containing the .ext extension, hit Spacebar and then hit Enter
  7. Select the partition from which the file was deleted and choose Search
  8. Select the partition type and hit Enter
  9. Navigate to the directory in which you wish to recover the deleted file(s) using Left / Right and hit C
  10. Wait, this might take a while based on your drive type (HDD/SSD) and on your drive size
  11. Browse to the folder in which you chose to recover the file(s) and see if your file was recovered
12
  • Wrong installation command, photorec is in the package testdisk.
    – UTF-8
    Apr 8, 2015 at 20:49
  • I tried it and got a number of files in the six-digits back. I then deleted them via search per file extension until I ended up with slightly more than 3'000 files which I then excluded or searched manually. It wasn't there. :(
    – UTF-8
    Apr 8, 2015 at 20:51
  • I'm searching for a video file, btw. Either content or the file name is okay, I don't need both.
    – UTF-8
    Apr 8, 2015 at 20:53
  • 1
    @UTF-8 Thanks, updated. If you are sure that it wasn't there, then I'm sorry but I don't think that's something else you could try despite trying to use another software to perform the same block-by-block search, but photorec is usually good, so I think odds that by switching program you'll be able to recover it are low
    – kos
    Apr 8, 2015 at 21:09
  • @UTF-8 Have a look at Elder Geek's comment above this one. In fact thinking about it I'm not sure that extensions are recoverable without ambiguity, since for example you can't distinguish a .conf file from a .txt file. That's probably different for media, since I think that the container can always be recognized, but maybe it's worth a shot
    – kos
    Apr 9, 2015 at 16:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .