Results 1 to 9 of 9

Thread: Undelete a file on NTFS

  1. #1
    Junior Member
    Join Date
    Mar 2011
    Posts
    3

    Undelete a file on NTFS

    I would like to know how to undelete a file in C:\Windows\System32 (NTFS) using Knoppix. Thanks. Ron

  2. #2
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    It doesn't do that. In fact you should never write to NTFS at all with Knoppix.
    ---
    Verifying of md5 checksum and burning a CD at slow speed are important.

  3. #3
    Member registered user
    Join Date
    Dec 2006
    Posts
    49
    Quote Originally Posted by Harry Kuhman View Post
    It doesn't do that. In fact you should never write to NTFS at all with Knoppix.
    Are you serious? I thought current mounting procedures, for current NTFS architecture, were completely robust.
    I've been reading / writing / editing / deleting for literally years. No problems encountered so far (and certainly not with Knoppix >= 5.1).
    Fergus

  4. #4
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    @fergus
    http://www.knoppix.net/forum/threads...king-with-ntfs
    never had a problem myself and never really listened to the warnings
    I don't think it's that unsafe anymore...

  5. #5
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    and look at this:http://www.howtogeek.com/howto/13706...buntu-live-cd/
    it's ubuntu but I think it's also in the debian repos?

  6. #6
    Junior Member
    Join Date
    Mar 2011
    Posts
    3
    I deleted the file while booted into safe-mode with command prompt so i don't think it went into the recycle bin. Does anybody here know what I'm talking about? Thanks! I think ntfsundelete only undeletes files from the recycle bin - is that correct?

  7. #7
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    if thats the case then ntfsundelete is the most useless utility I've ever seen

  8. #8
    Senior Member
    Join Date
    Jan 2011
    Posts
    242
    I'm confused. I thought this was the Knoppix forums and so not the place to ask trickly Windoze questions. Did someone on a Windoze forum say they couldn't help and suggest you try your luck on the Knoppix forums ?

    My simple understanding is that NTFS is a secure file system in the sense that the old VFAT is not. That means that when you delete a file under Windoze (instead of just sin binning it), it is supposed to stay deleted. The same security means the data in the file isn't deleted and it could be a long time before it is over written. So while you can't get to your data any more, those from whom you have nothing to hide can. To find out more, ask at micro$oft.com.

    There is a Linux package called ntfsprogs containing a tool called ntfsundelete that doesn't respect your privacy and can be used to recover (note recover, not restore) deleted files if you are lucky. Our friend dinosoep has very kindly given a reference to a dummies guide to the ntfsundelete command. Knoppix comes with the ntfsprogs package already installed. So what more do you want ? I'm not about to go out and buy Windoze in order to install on an otherwise perfectly happy PC so I can trash the installation just so I can see if the tool does what the documentation says it does. Try it for yourself.

    The command, despite it's name, does not undelete files. It will copy deleted files somewhere safe (i.e. your Knoppix home directory so if you're using a CD, don't reboot). It does not write to the NTFS partition, it only reads from it. Harry would approve.

    First recover your lost file and save it to a USB stick. Then worry about how to get it back onto your Windoze machine. If your Windoze won't boot, dinosoep might be able to help. If Windoze will boot, do the drag-and-drop thing Windoze users are so good at.

    As for you dinosoep, you should be ashamed of yourself.

    I cross the road everyday and I've been doing it for years and I've never been run down but I'm not about to encourage anyone not to take road safety seriously. Harry is a System Administrator. That's like being a doctor in the ER (ED or whatever it's called in your timezone). He gets to see the results of 'accidents', gets to clean up the mess of other people's foolishness and sometimes the joy of saying "We did all we could but your file system was too badly damaged" and seeing the look of horror on their faces.

    Harry's views may sound extreme but I take him seriously. Consider how and why you use NTFS file systems from Linux and look to reduce / eliminate that use. Need extra storage ? Use your NAS. Want to share files ? Repartition your disk so you've a C: and a D:. Windoze is on C: and so is your Windoze home directory. Don't write to C: from Linux, only to D: then you can't destroy your C: drive by accident.

    Yes, ntfs-3g is as safe as they can make it. No, it doesn't do dangerous things like mess with ACLs. But no file system is totally bullet proof. Even Linux file systems can be corrupted when the power outs. ntfg-3g is a fuse file system. By definition, it is more vulnerable. So you don't mind taking risks. By definition, ntfs-3g is also slower and needs more memory and CPU resources than kernel file systems. There is no good reason to use ntfs-3g long term other than sloth.
    Last edited by Forester; 03-09-2011 at 12:11 AM.

  9. #9
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    oops, never looked at it that way.
    and I didn't knew ntfs was slower.
    maybe I should consider creating a new partition, it's no big deal because I already have the ext3 drivers on my 'windoze' installed.
    It's just that I've seen windows itself ruin the ntfs part more then linux mint that frequently writes to ntfs and has helped restoring it again and again...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


Cisco Nexus 48-Port 10G SFP+ Switch N9K-9396PX w/ 9K-M12PQ 12-Port 40G QSFP picture

Cisco Nexus 48-Port 10G SFP+ Switch N9K-9396PX w/ 9K-M12PQ 12-Port 40G QSFP

$419.99



Cisco ASR1002-HX Router 10GE Port, w/ 2AC Power Supplies-Lifetime Warranty picture

Cisco ASR1002-HX Router 10GE Port, w/ 2AC Power Supplies-Lifetime Warranty

$4195.00



Cisco C9300-NM-8X Catalyst 9300 Series 8x 10G Network Module picture

Cisco C9300-NM-8X Catalyst 9300 Series 8x 10G Network Module

$390.00



Cisco 2901 Integrated Services Router picture

Cisco 2901 Integrated Services Router

$50.99



Cisco WS-C3850-48P-L 48-Port Gigabit 3850 PoE Switch w/ 715W+ C3850-NM-4-1G Mod picture

Cisco WS-C3850-48P-L 48-Port Gigabit 3850 PoE Switch w/ 715W+ C3850-NM-4-1G Mod

$79.00



Cisco Nexus N3K-C3048TP-1GE 48 Port Switch w/ Dual Power - Same Day Shipping picture

Cisco Nexus N3K-C3048TP-1GE 48 Port Switch w/ Dual Power - Same Day Shipping

$85.99



Genuine Cisco SFP-10G-SR V03 10GBASE-SR SFP+ Transceiver Module 10-2415-03  picture

Genuine Cisco SFP-10G-SR V03 10GBASE-SR SFP+ Transceiver Module 10-2415-03

$8.00



Cisco Catalyst 3850 Series 48-Port UPoE Gigabit Switch w/ C3850-NM-2-10G (BHN) picture

Cisco Catalyst 3850 Series 48-Port UPoE Gigabit Switch w/ C3850-NM-2-10G (BHN)

$109.95



Cisco C9300-48U-A 48-Port Gig UPoE Network Advantage Switch -Same Day Shipping picture

Cisco C9300-48U-A 48-Port Gig UPoE Network Advantage Switch -Same Day Shipping

$859.95



Cisco Nexus N3K-C3172PQ-XL 48P 10GbE SFP+ 4P QSFP+ Switch N3K-C3172PQ-XL-F picture

Cisco Nexus N3K-C3172PQ-XL 48P 10GbE SFP+ 4P QSFP+ Switch N3K-C3172PQ-XL-F

$229.00