Recover deleted files on an NTFS hard drive from a Ubuntu Live CD

Accidentally deleting important files is a frustrating experience, and it’s even worse when your Windows system won’t boot, leaving you without access to standard recovery tools. Fortunately, Ubuntu, a free and user-friendly Linux operating system, provides a powerful alternative. Using an Ubuntu Live CD or bootable USB, you can access your hard drive independently of Windows and recover deleted files, even from NTFS-formatted drives common to Windows systems.

This method of recovery utilizes a command-line tool called ntfsundelete, which scans your drive for deleted files and restores those that have not been overwritten. Whether you are dealing with photos, videos, or documents, this method can be used to recover your data without installing additional software or even requiring Windows to function. This guide will assist you in recovering lost data by guiding you through each step, from booting into Ubuntu to restoring your files.

How to recover deleted files on an NTFS drive with Ubuntu Live CD

1. Boot from Ubuntu Live CD/USB
   • Insert your Ubuntu Live CD/USB and boot from it.
   • Once Ubuntu loads, open the Terminal by going to Applications (on the top left of your screen) > Accessories > Terminal.
2. Identify the correct NTFS partition
   • Type the following command and press Enter to run it: sudo fdisk -l
   • Look for the partition with HPFS/NTFS under the System column.
   • Note the device name (e.g., /dev/sda1) based on the size and format of the drive. It might be different from yours, but it will still start with /dev.
3. Scan the drive for recoverable files
   • Enter the command (replace with your actual drive name): sudo ntfsundelete /dev/sda1
   • View the list of recoverable files. The file names appear on the right, and the recoverability percentage is in the third column.
4. Recover files by file type
   • To recover all .jpg files, use: sudo ntfsundelete /dev/sda1 -u -m *.jpg
   • The recovered files will be saved in your current working directory (usually the Desktop or Home folder).
5. Recover files using the Inode number
   • From the scan results, find the Inode number in the first column of the file you want to recover.
   • Use this command to recover the specific file: sudo ntfsundelete /dev/sda1 -u -i <Inode>
   • Replace <Inode> with the number shown for your file.
6. Fix file permissions
   • Recovered files are saved with ownership set to the root user.
   • To change ownership to your current Ubuntu user (usually “ubuntu”), run: sudo chown ubuntu *
   • This changes the ownership of all files in the current directory to the Ubuntu user.

Conclusion

It can be a frustrating experience to accidentally delete files, especially if Windows is unable to start. However, there are practical solutions available, such as ntfsundelete. Using an Ubuntu Live CD or USB allows you to bypass Windows entirely and access your NTFS hard drive securely. Using just a few Terminal commands, you can search for deleted files, recover them by name or Inode, and adjust permissions to make them usable again.

Although it lacks a graphical interface, NTFS Undelete is a powerful and effective tool when time and data are critical. This method offers a free, flexible, and reliable method for recovering lost files, whether they are precious photographs or important documents. Understanding how to use this tool can be a valuable skill when it comes to troubleshooting technical problems.