Recovering a Moved or Deleted File From an NTFS File System in Linux

Or at least trying to

Nine months ago, my potato of a laptop died on me. Not dead as in dead in the water but soon will surely be. Running more than one app makes the whole system freeze for like 20 minutes. Who could work with that? I was running Lubuntu, supposedly the lightest and fastest in the Ubuntu family or Debian derivatives for that matter.

I could still boot it up and access the file manager. So after setting up my new gaming rig, I started migrating my files by manually moving them using a 32gb flash drive.

An aftershock-like unfortunate event happened. The flash drive got corrupted and I’m suspecting it was during the copy. As I used move (cut then paste) instead of copy (copy then paste), the original files were already gone and some files in the flash drive went missing.

One of the missing files were very important to me. I slept that night trying to convince myself that it’s gone for good.

When I woke up the next morning, I remembered that (speaking as a layman) data from the files you delete aren’t really deleted, just the reference to it. The move action is just the same as copying and deleting so I did a quick search online on how to recover deleted files. I found a tool called ntfsundelete.

So I immediately tried it and I was able to recover my precious text file and some others that were not as important. Here’s how I did it with a Linux terminal.

$ ntfsundelete -sf -m "filename.txt" /dev/sda3

That was just a scan if the partition still had data about the specified file name. It returned with a message that it found the file and is recoverable. Next, I did the actual recover command:

$ ntfsundelete -uf -m "filename.txt" /dev/sda3

That was it! My file was back from the world of the void.

Just note that it’s not always a happy ending. Sometimes, the space where the “deleted” file’s data lives on is used by another file that either you or the system created.

In case you need to recover files from an EXT3 or EXT4 file system, there’s also the extundelete tool. As for Windows you could use apps like Stellar Phoenix which I tried earlier on the corrupted flash drive on my new computer but had no luck.

If you have questions, you can drop a comment below, send me an email, or join my Discord channel and I would answer them to the best of my knowledge.