{"id":220,"date":"2012-12-25T18:37:22","date_gmt":"2012-12-25T18:37:22","guid":{"rendered":"http:\/\/www.buildingcubes.com\/?p=220"},"modified":"2012-12-25T18:37:22","modified_gmt":"2012-12-25T18:37:22","slug":"undeleting-files-from-windows-partitions","status":"publish","type":"post","link":"https:\/\/www.voodoo.business\/blog\/2012\/12\/25\/undeleting-files-from-windows-partitions\/","title":{"rendered":"Undeleting files from windows partitions"},"content":{"rendered":"<p>So, i will be doing this under linux for a good reason<\/p>\n<p>My friend gave me his computer so that i can recover everything for him, he deleted all the photos and so many other things, photos of his family are most important to him.<\/p>\n<p>So, becuase i have been holding his computer hostage for a week now, i decided to copy the entier hard drive so i can give him his computer back, and extract everything at my convinience, so after mountingf the disk i want to undelete from&#8230; i executed the command.<\/p>\n<p>ddrescue \/dev\/sdb \/hds\/3tb\/200gb.img \/root\/resumelog.log<\/p>\n<p>So i had the image file that i can use for recovery after mounting<\/p>\n<p>Now if as in the article here http:\/\/www.buildingcubes.com\/2012\/07\/27\/rescuing-a-failed-hard-drive\/ i mounted the drive, i can use a nice linux command (ntfsundelete) to undelete the files from the mounted partition.<\/p>\n<p>1- create a list of files to take a look at, put all deleted JPGs in a text file<br \/>\nntfsundelete \/hds\/img -m &#8216;*.jpg&#8217; -p 80 -t 8m > deletedmp3.txt<br \/>\nntfsundelete \/dev\/loop0 -m &#8216;*.zip&#8217; -p 50 -t 8m > deletedjpg.txt<\/p>\n<p>2- change to the directory where you want to recover files to<br \/>\ncd \/hds\/wd1tb\/newdir<\/p>\n<p>3- recover all PNG files then all jpg files<br \/>\nntfsundelete \/dev\/sda1 \u2013u \u2013m *.png<br \/>\nntfsundelete \/dev\/sda1 \u2013u \u2013m *.jpg<\/p>\n<p>or if i want to move them to a directory other than the active directory<br \/>\nntfsundelete \/dev\/sda1 -u -m &#8216;*.jpg&#8217; -p 90 -t 8m -d \/hds\/wd1tb\/newdir<\/p>\n<p>-p 90 means only recover files with at least 90% recoverable content<br \/>\n-t 5m means only files deleted in the past 8 months<\/p>\n","protected":false},"excerpt":{"rendered":"<p>So, i will be doing this under linux for a good reason My friend gave me his computer so that i can recover everything for him, he deleted all the photos and so many other things, photos of his family are most important to him. So, becuase i have been holding his computer hostage for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-220","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/comments?post=220"}],"version-history":[{"count":0,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/posts\/220\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/media?parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/categories?post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.voodoo.business\/blog\/wp-json\/wp\/v2\/tags?post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}