Hi Andreas,
> I'd like to undelete a file from a partition that was deleted some time
> ago.
OK, that's already a bad start.
> I must admit that I have since created another partition and
> installed a new Win XP on that drive, but I did only quick format that
> partition.
It gets worse.
> I know the filename of the file and tried "ntfsundelete -m filename
> /dev/sda1", but unfortunately, ntfsundelete does not even try to search.
That's not how ntfsundelete works. NTFS has a table of filenames. When
a file is deleted, its entry in that table is marked as unused.
By quick formatting the partition you have probably written over the
original filename table, so now we have no idea where the file is.
Also, if that file is in several pieces, then even if you find the first
part, you might have difficulty finding the rest.
Then you installed Windows on top. If that file was in the first, say,
4GB of that disk, it's almost certainly been overwritten.
> It finishes within seconds. I am using the Ubuntu packages version 1.9.4
> of ntfsprogs, will later versions do better?
No, it won't help.
> I'd also prefer to seach on the disk device itself (/dev/sda) rather
> than a partition that was added later (/dev/sda1). But ntfsundelete is
> not happy about that (/dev/sda).
Yes, it only works on intact NTFS partitions.
> If ntfsprogs will not do, is there a Linux based alternative?
Don't know.
Cheers,
FlatCap (Rich)
nt...@fl...
|