FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Mon Jun 21, 2021 02:40



Post new topic Reply to topic  [ 12 posts ] 
ntfsundelete - not able to recover filenames 
Author Message

Joined: Fri Sep 23, 2011 18:48
Posts: 3
Post ntfsundelete - not able to recover filenames
Hi!

I accidentally deleted a bunch of files from an external USB HDD. I immediately disconnected the power plug when noticing the wrong command. ntfsundelete now finds about 16000 files with 100% restore probability, but none of the 16k files has a file name assigned to it.
The manual states that it's possible for some files to miss the file name, but how likely is it that 16k files are missing it? What can I do about that? Any suggestions?

Besides that I have the problem that when trying to recover the files I have to invoke ntfsundelete for every single inode providing an output file name. Otherwise it would fail because the file 'unknown' is already existing. That's really slow. Any hint's about that? Or is ntfsundelete slow in any case and the invocation overhead is neglectable?

thx in advance


Fri Sep 23, 2011 19:08
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete - not able to recover filenames
Hi,

Quote:
none of the 16k files has a file name assigned to it.
The manual states that it's possible for some files to miss the file name, but how likely is it that 16k files are missing it?

Well, when you delete a file, you actually only delete the name, and when there is no more name, the file is declared deleted, though almost everything is still in place... except the file names (and pointers to their parent directories).

However :

The file name is part of an MFT record (fixed size, generally 1K), and when the name is deleted, the remaining parts of record are shifted, making the name unusable. I have made a few tries which show that, under some conditions, the new end of record can be located in front of the former file name, and the name can still be there. Apparently ntfsundelete never examines beyond the end of record, so there is room for improvement. If you have 16000 files to undelete this is worth trying, even with 50% success.

I need a few days to check further and make a proposal.

PS do you use non-ascii characters in your file names ?

Regards

Jean-Pierre


Fri Sep 23, 2011 22:21
Profile

Joined: Fri Sep 23, 2011 18:48
Posts: 3
Post Re: ntfsundelete - not able to recover filenames
Quote:
PS do you use non-ascii characters in your file names ?


One problem is that I don't exactly know which files got deleted. Usually I avoid using non-ascii chars, but there is a high probability that there are at least some file names containing non-ascii...

I've already identified some files to be pictures (raw + jpg), they definitely don't have non-ascii chars in their file name.

regards,
Michael


Sat Sep 24, 2011 09:38
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete - not able to recover filenames
Hi Michael,

Can you try the attached patch ?

This is for trying to recover file names. For the name to be recoverable, the file must not be fragmented, it must not be too small, it must not have been created by an old ntfs-3g, and other conditions, which exclude directories. There is no check on characters used in file names, so you may end up with strange names.

When a file name cannot be recovered, it is assigned a name such as "unknown12345" where 12345 is the inode number. This is easier to deal with when you have a lot of unnamed files.

Hope this helps.

Regards

Jean-Pierre


Attachments:
ntfsundelete.c.patches.gz [1.7 KiB]
Downloaded 903 times
Sat Sep 24, 2011 16:40
Profile

Joined: Fri Sep 23, 2011 18:48
Posts: 3
Post Re: ntfsundelete - not able to recover filenames
Quote:
Can you try the attached patch ?

Works great, thanks a lot!
I now have only 899 out of 16324 files without file names. The vast majority is smaller than 1k.

I didn't try to recover the files using your "name unknown files with inodes" patch yet. First I have to screen the file names given by the scan to figure out which files were deleted and which files I have to recover...

thx again,
Michael


Sun Sep 25, 2011 14:57
Profile

Joined: Wed Feb 29, 2012 23:45
Posts: 5
Post Re: ntfsundelete - not able to recover filenames
I'm still a total Linux n00b even though I've been installing it since the late 1990's. I've accidentally deleted a few files (5TB) :evil: playing around with NFS. Most if not all of the files which are recoverable as you have said have no file name. I've downloaded your patch hoping there was some sort of instruction to tell me what to do with it. Some assistance would be appreciated. I've compiled programs from source before so I'm not totally hopeless.


Wed Feb 29, 2012 23:59
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete - not able to recover filenames
Hi,

Can you post a sample of what you get (also your ntfs-3g version).

Regards

Jean-Pierre


Thu Mar 01, 2012 07:36
Profile

Joined: Wed Feb 29, 2012 23:45
Posts: 5
Post Re: ntfsundelete - not able to recover filenames
jpa wrote:
Hi,

Can you post a sample of what you get (also your ntfs-3g version).

Regards

Jean-Pierre


I hope this is what you're asking for.

135 D... 0% 2012-02-27 0 <none>
136 FN.. 100% 2007-08-14 575357194 <none>
137 D... 0% 2012-02-27 0 <none>
138 FN.. 100% 2009-12-13 781804555 <none>
139 FN.. 100% 2009-12-06 781870695 <none>
140 FN.. 100% 2009-11-30 781942283 <none>
141 FN.. 100% 2009-11-22 781962995 <none>
142 FN.. 100% 2009-11-15 781983727 <none>
143 FN.. 100% 2009-11-08 782025685 <none>
144 FN.. 100% 2009-11-01 782086455 <none>
145 FN.. 100% 2009-10-26 782249183 <none>
146 FN.. 100% 2012-02-07 1184565319 <none>
147 FN.. 100% 2011-06-01 2704812071 <none>
148 FN.. 100% 2012-02-08 9242 <none>
149 FN.. 100% 2012-02-08 173687 <none>

I'm running Ubuntu 11.10 with ntfs-3g v1:2011.4.12AR.4-2ubuntu3

I've successfully undeleted inodes 138-147, individually, renaming as I go. I'm wondering now if it wouldn't be possible and/or easier to to run a script reading the inode number from a file, undeleting and then naming the file inode###.mkv. It's been more than 20 years since I've done any real batch file or script writing though so I'm a little rusty.


Thu Mar 01, 2012 18:24
Profile

Joined: Wed Feb 29, 2012 23:45
Posts: 5
Post Re: ntfsundelete - not able to recover filenames
I should add that there shouldn't be non-asci characters in the file names. A typical name would be "A TV Show S00E00.mkv". File sizes range from 400MB to 20GB.

I ran #sudo ntfsundelete -S 400000000-20000000000 /dev/sdb1 > info.txt and got 1050 lines. Of those I expect less than 50 will not be valid because they have file names and only 2 show less than 100%.


Thu Mar 01, 2012 20:15
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete - not able to recover filenames
Hi,

First of all : be sure to mount your device read-only, so that you do not overwrite useful data by mistake.

Then, be sure to use a ntfs-3g version which can (under conditions) recover file names. You need at least 2011.10.9-RC. The original 2011.4.12AR.4-2 cannot extract the file names (unless you apply the patches posted earlier to this thread).

Code:
148 FN.. 100% 2012-02-08 9242 <none>

For that file (moderate size), I would expect the name to be recoverable. But are you using a correct version or did you apply the patch correctly ? With a recent version you should get an individual name (the original one or an artificial one) instead of <none>. Please download the latest version and compile again.

Code:
138 FN.. 100% 2009-12-13 781804555 <none>

For such big files, new problems arise, and the file name may have been overwritten. The good news is that 100% of the data is recoverable.

Code:
137 D... 0% 2012-02-27 0 <none>

This was a directory. The names of directories and small files (< ca 600 bytes) are not recoverable.

Quote:
I'm wondering now if it wouldn't be possible and/or easier to to run a script reading the inode number from a file, undeleting and then naming the file inode###.mkv

I would expect so if you switched to a newer version. Please also post the output of
Code:
ntfsinfo -m /dev/sdb1

this will tell me where the metadata is located, so that I will be able later to check whether the file names are still present.
Quote:
I should add that there shouldn't be non-asci characters in the file names.

This should not matter.
Quote:
Of those I expect less than 50 will not be valid because they have file names

If file names are shown, you can easily recover them, and check recoverability : if you get
Code:
1734     FN..   100%  2009-05-06     37992  ca0106.h

To recover the file as ca0106.h, just do :
Code:
ntfsundelete -f -Tui 1734 -o ca0106.h /dev/sdb1

(this can be automated, but first check whether you get the correct file).
Quote:
only 2 show less than 100%.

For those files, you may recover the names, but not the data.

Regards

Jean-Pierre


Thu Mar 01, 2012 22:39
Profile

Joined: Wed Feb 29, 2012 23:45
Posts: 5
Post Re: ntfsundelete - not able to recover filenames
Thanks Jean-Pierre, I'll do that in the morning when I get home and let you know how it works.


Fri Mar 02, 2012 07:32
Profile

Joined: Wed Feb 29, 2012 23:45
Posts: 5
Post Re: ntfsundelete - not able to recover filenames
It's working great. :P

There are still many files with no name but I'm not even going to bother to try batch programming it. In approximately 1 hour I've managed to recover over 100 files and as I type this I've got 150 saved with 2/3 with names. I consider that to be fantastic.

Here's the output from ntfsinfo -m /dev/sdb1

cd Volume Information
Name of device: /dev/sdb1
Device state: 11
Volume Name: TV
Volume State: 91
Volume Version: 3.1
Sector Size: 512
Cluster Size: 4096
Index Block Size: 4096
Volume Size in Clusters: 366284000
MFT Information
MFT Record Size: 1024
MFT Zone Multiplier: 0
MFT Data Position: 24
MFT Zone Start: 786432
MFT Zone End: 46571932
MFT Zone Position: 786432
Current Position in First Data Zone: 46571932
Current Position in Second Data Zone: 0
LCN of Data Attribute for FILE_MFT: 786432
FILE_MFTMirr Size: 4
LCN of Data Attribute for File_MFTMirr: 91571500
Size of Attribute Definition Table: 2560
FILE_Bitmap Information
FILE_Bitmap MFT Record Number: 6
State of FILE_Bitmap Inode: 80
Length of Attribute List: 0
Attribute List: (null)
Number of Attached Extent Inodes: 0
FILE_Bitmap Data Attribute Information
Decompressed Runlist: not done yet
Base Inode: 6
Attribute Types: not done yet
Attribute Name Length: 0
Attribute State: 3
Attribute Allocated Size: 45789184
Attribute Data Size: 45785504
Attribute Initialized Size: 45785504
Attribute Compressed Size: 0
Compression Block Size: 0
Compression Block Size Bits: 0
Compression Block Clusters: 0


Fri Mar 02, 2012 17:06
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 12 posts ] 


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.