Undelete on ntfs
FedoraForum.org - Fedora Support Forums and Community
Results 1 to 4 of 4
  1. #1
    Join Date
    Jul 2014
    Location
    EU
    Posts
    271
    Linux Pale Moon 28.0.1

    Undelete on ntfs

    chkdsk in Win.8 deleted files with "wrong" filename. Is it please possible to undelete them ? Testdisk does not see any deleted file.

    These files were in fact removed to found.001 folder and renamed to fileXYZ.chk

    Is it please possible to restore original file name or path ?

  2. #2
    Join Date
    Feb 2011
    Posts
    193
    Solaris Firefox 45.0

    Re: Undelete on ntfs

    chkdsk does not delete files with names it does not like, it renames them into the "System Volume Information" Directory.

    If you want to be prevented from creating files with names not approved by Windows, you can use the mount option "windows_names".

    If you want to undelete files recently deleted, check "man ntfsundelete"

  3. #3
    Join Date
    Feb 2011
    Posts
    193
    Solaris Firefox 45.0

    Re: Undelete on ntfs

    Here is a way to associate the file with its original name (this might sound technical, sorry about it) :

    chkdsk logs its actions in the directory "System Volume Information/Chkdsk". The logs are encoded in utf16, but using "cat" you can display them to the terminal, and you will find something like :

    Code:
    [root@dimension ntfslowprof]# cat 'disk/System Volume Information/Chkdsk/Chkdsk20180909140428.log'
    [...]
    Stage 2: Examining file name linkage ...
    
    The NTFS file name attribute in file 0x5f is incorrect.
    5a 00 3a 00 61 00 7a 00 65 00 72 00 74 00 79 00  Z.:.a.z.e.r.t.y.
    File 5F has been orphaned since all its filenames were invalid
    Windows will recover the file in the orphan recovery phase.
    Correcting minor file name errors in file 5F.
    Note the file name "Z:azerty" and the number 5F, which is hexadecimal value for 95.

    Now get the inodes numbers for "files*.chk" :

    Code:
    [root@dimension ntfslowprof]# ls -li disk/found.001/file00000000.chk
    95 -rw-r--r-- 1 root root 7 Sep  9 16:03 disk/found.001/file00000000.chk
    The 95 at the beginning of the line shows this is the file which was originally named Z:azerty

  4. #4
    Join Date
    Jul 2014
    Location
    EU
    Posts
    271
    Linux Pale Moon 28.1.0

    Re: Undelete on ntfs

    Thank you very much, that's exactly what I was looking for

Similar Threads

  1. Undelete
    By YellowDog in forum Using Fedora
    Replies: 5
    Last Post: 5th October 2010, 07:48 PM
  2. undelete software?
    By kernel_klink in forum Using Fedora
    Replies: 5
    Last Post: 12th October 2009, 01:35 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •