FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Wed Aug 04, 2021 00:49



Post new topic Reply to topic  [ 8 posts ] 
ntfsundelete how-to - Folder recovery 
Author Message

Joined: Wed Sep 19, 2012 03:32
Posts: 5
Post ntfsundelete how-to - Folder recovery
Hi.
Listen, first of, I know I can just RTFM or so, but this is a matter of case that cannot allow try and error. I accdentely 'rm' an entire folder from my external HD. This particular folder was big, like 700GB or so, more or less.

So, i just did the screw up and imediately found out about ntfsprogs and ntfsundelete. Here's the question: how can I recover an entire folder? Or similarly, how can I recover all the files listed in :
Code:
ntfsundelete /dev/partition -p 100
at once? Or maybe an script to automate this process? 'Cause theres a lot of files of mixed extensions (.mp4, .mkv, .avi, .mp3, .jpg, .png, you name it), and i'm not really a linux wizard, never wrote a script beyond the "Hello world!" level.

Necessary to say, that this is my back-up HD, so I don't have space in the actul notebook's HD to recover to and move after to the external one. Any way that i can recover to a second external HD? I don't mind re-arrenge the tree folder structure afterwards, but I really need to have confidence that the files listed 100% recoverable are recovered safely.

I thanks in advance for any help provided. Sorry if i mispelled something.

~Dias (Brazil)


Wed Sep 19, 2012 04:19
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete how-to - Folder recovery
Hi,

Quote:
I accdentely 'rm' an entire folder from my external HD.

Bad luck !

First of all, only mount the damaged partition as read-only, and do not try recovering files to the same partition, you would overwrite the deleted files.
Quote:
I know I can just RTFM or so, but this is a matter of case that cannot allow try and error.

Yes you can. If you only mount read-only you cannot delete data.
Quote:
how can I recover an entire folder?

With ntfsundelete you can recover the files which have been deleted and not overwritten, but you generally cannot identify the original path.

The first step is to run with option -s :
Code:
ntfsundelete -s /dev/sdxx

and you get a list of recoverable files, such as :
Code:
8661     FN..   100%  2008-04-29      1194  Thierache.htm
8662     F..!     0%  2012-08-14         0  <none>
8663     FN..   100%  2008-04-29      4601  ea08-b38.jpg
8664     FN..   100%  2008-04-29     71366  ed08-b37.jpg

and you can RTFM to proceed further.

Regards

Jean-Pierre


Wed Sep 19, 2012 09:14
Profile

Joined: Wed Sep 19, 2012 03:32
Posts: 5
Post Re: ntfsundelete how-to - Folder recovery
Thanks jpa, i got that so far. And thanks for remind me to mount RO (I wasn't).
But still, I have the issue that there are several kinds of files.
Code:
ntfsundelete /dev/partition -p 100
[1]
returns about 4180 recoverable files of sorted extensions, including some that i don't remind of.

The method that most speed the process, i imagine, would be using wildcards like in:
Code:
ntfsundelete /dev/partition -u -m *avi
[2]
And repeat that for each kind of file, and that would still take me too much time. I belive an script suit here. For instance, if I found out a way to make a list with the filenames listed in the output of [1] in a manner that each filename be separeted by a newline char and pass that list to ntfsundelete. Again, I don't really have any expertise in this manner, any help for that kind of automation instead the use of brute force is apreciated.

Other than that, I believe that i figured the ntfsundelete already. I am RTFM since the beggining.

Thanks.
~Dias


Wed Sep 19, 2012 12:23
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete how-to - Folder recovery
Hi,

Quote:
The method that most speed the process, i imagine, would be using wildcards like in:
Code:
ntfsundelete /dev/partition -u -m *avi

You have to single-quote '*.avi' because you are not selecting names from the current directory, but pass '*.avi' to ntfsundelete for it to filter names :
Code:
ntfsundelete /dev/partition -u -m '*avi'

Note : sometimes the original name is not recoverable and it is replaced by "unknown" with a number appended. So you should also extract those files :
Code:
ntfsundelete /dev/partition -u -m 'unknown*'


Regards

Jean-Pierre


Thu Sep 20, 2012 08:41
Profile

Joined: Wed Sep 19, 2012 03:32
Posts: 5
Post Re: ntfsundelete how-to - Folder recovery
Thanks Jean. I will do.

In the meantime, I am still looking for a second back-up space to which to recover the files to.

And just to reinforce, if any one have an idea of how to do an script such as I described, it would be helpful for many. I currently just don't have the time to study scripting.

Regards,
~Dias


Thu Sep 20, 2012 12:08
Profile

Joined: Wed Sep 19, 2012 03:32
Posts: 5
Post Re: ntfsundelete how-to - Folder recovery
Hi. So I acctualy did a few trys, and this is the solution i got:
Code:
ntfsundelete -p 100 /dev/device > infile
With this infile, I edited and clean the table leaving only the inode numbers in the file, and added commas at the end of each line, so I can use the infile as in:
Code:
ntfsundelete -u -i `cat infile` -d /mounted/ext_hd  /dev/device
to recover the files to the external hd.
The thing is, apparently the backtick isn't working, as the command returns the help table and the following message:
Quote:
You must specify exactly one device.
I don't know what's wrong in the command given. Any thoughs?

~Dias


Mon Sep 24, 2012 04:30
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: ntfsundelete how-to - Folder recovery
Hi,

Quote:
I edited and clean the table leaving only the inode numbers in the file, and added commas at the end of each line, so I can use the infile as in:
Code:
ntfsundelete -u -i `cat infile` -d /mounted/ext_hd  /dev/device

to recover the files to the external hd.
The thing is, apparently the backtick isn't working, as the command returns the help table and the following message:

Code:
According to the manual :
       -i, --inodes RANGE
              Recover the files with these inode numbers.  RANGE can be a sin-
              gle  inode  number, several numbers separated by commas "," or a
              range separated by a dash "-".

So, what is expected is a single line, with a sequence of inode numbers separated by commas and no extra characters (no space, etc.).

Moreover, you probably will have to split the inode list, otherwise you might reach some command line length limit.

It might be simpler to use a text editor to prepend "ntfsundelete -u -i " to each line of infile, and append " -d /mounted/ext_hd /dev/device" (removing your inserted commas), so that you get a file with one ntfsundelete command per line. Then make it executable and execute it :
Code:
chmod 755 infile
./infile

Regards

Jean-Pierre


Mon Sep 24, 2012 10:10
Profile

Joined: Wed Sep 19, 2012 03:32
Posts: 5
Post Re: ntfsundelete how-to - Folder recovery
Thx jpa. It's working while I'm typing the reply.

I did the adjustment of pre and append with sed.
Code:
sed -i.bak "s/^/ ntfsundelete[...]"
and
Code:
sed -i.bak "s/$/ -d [...]


~Dias


Fri Sep 28, 2012 05:02
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 


Who is online

Users browsing this forum: Majestic-12 [Bot] and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.