Recover accidentally removed files on NTFS partition

I accidentally removed some files on a NTFS partition

How can I recover them staying inside Linux without rebooting ?

Solution 1:

The Ubuntu Wiki has a lenghty topic on data recovery and, luckily for you, also has a segment on recovering files deleted from a NTFS partition. From that part of the link:

Ntfsprogs

ntfsprogs can recover deleted files from an NTFS file-system. The Windows and LiveCd versions have a very nice intuitive gui but the linux one is probably stronger and does not have a front-end gui at the moment.

Briefly, it has 3 modes

1. Scan. searches for deleted files and find info about them
2. Undelete. See below.
3. Copy.

When undeleting chose which files to undelete and where to undelete them too. By default this appears to be the desktop of the OS you are booted into, whether that is a LiveCd or on a different partition or drive. For a LiveCd or LiveUsb you will need to move them onto Usb-stick or safe partition before rebooting as the desktop gets forgotten on LiveCds unless you are using a Persistent image.

To search

ntfsundelete /dev/sda2

To undelete

ntfsundelete /dev/sda2 -u -i 3689 -o work.doc -d ~/output

This will write all recovered files (in this case word.doc) from/dev/sda2 (be sure to find out the device name of your NTFS partition) in a directory output inside your home directory.

For better information on using ntfsundelete please see the separate page NtfsUndelete, particularly the External Links there.

Besides the part of the wiki it also contains this external link explaining NtfsUndelete with images.