Re: [Linux-NTFS-User] Undeleting a file from a deleted partition?

[Yuval <yu...@gm...>]

On 8/29/05, Andreas Schildbach <an...@sc...> wrote:
> Hi everyone,
>=20
> I'd like to undelete a file from a partition that was deleted some time
> ago. I must admit that I have since created another partition and
> installed a new Win XP on that drive, but I did only quick format that
> partition.

When you reformatted the partition you have destroyed all the meta
data of that volume. The meta data includes a list of files and their
location of the drive (The MFT - Master File Table).
Therefore, ntfsundelete is unable to find the requested file.

It is possible that the file was in the end of the previous MFT, and a
newly created volume did not overwrite that section on the drive. It
means that it may be possible to locate the file using manual methods.
In this case you must not run Windows again with that drive (even as a
slave device), since even when not altering any file, Windows writes
stuff on the volume for its private use.

Doing a quick format means that there is a strong chance that the file
contents are untouched, but it is very difficult to locate it on the
drive. In this case, knowing something about the file's contents may
be useful for the recovery.

I advise you to contact some local data recovery company and maybe
salvage the file. Some people reading this list may help you for money
if you wish.

> I'd also prefer to seach on the disk device itself (/dev/sda) rather
> than a partition that was added later (/dev/sda1). But ntfsundelete is
> not happy about that (/dev/sda).

The device is not an NTFS volume. It has a partition table. Non of the
ntfsprogs utilities will be happy with it.

> If ntfsprogs will not do, is there a Linux based alternative? I'd like
> to chick around installing Win XP one more time and using EasyRecovery
> just for this one file.

It is theoretically possible to construct a tool that will partly
work. I don't know any, but you should keep searching.

Sincerely
-- Yuval