Results 1 to 9 of 9

Thread: Undelete a file on NTFS

  1. #1
    Junior Member
    Join Date
    Mar 2011
    Posts
    3

    Undelete a file on NTFS

    I would like to know how to undelete a file in C:\Windows\System32 (NTFS) using Knoppix. Thanks. Ron

  2. #2
    Administrator Site Admin-
    Join Date
    Apr 2003
    Location
    USA
    Posts
    5,441
    It doesn't do that. In fact you should never write to NTFS at all with Knoppix.
    ---
    Verifying of md5 checksum and burning a CD at slow speed are important.

  3. #3
    Member registered user
    Join Date
    Dec 2006
    Posts
    49
    Quote Originally Posted by Harry Kuhman View Post
    It doesn't do that. In fact you should never write to NTFS at all with Knoppix.
    Are you serious? I thought current mounting procedures, for current NTFS architecture, were completely robust.
    I've been reading / writing / editing / deleting for literally years. No problems encountered so far (and certainly not with Knoppix >= 5.1).
    Fergus

  4. #4
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    @fergus
    http://www.knoppix.net/forum/threads...king-with-ntfs
    never had a problem myself and never really listened to the warnings
    I don't think it's that unsafe anymore...

  5. #5
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    and look at this:http://www.howtogeek.com/howto/13706...buntu-live-cd/
    it's ubuntu but I think it's also in the debian repos?

  6. #6
    Junior Member
    Join Date
    Mar 2011
    Posts
    3
    I deleted the file while booted into safe-mode with command prompt so i don't think it went into the recycle bin. Does anybody here know what I'm talking about? Thanks! I think ntfsundelete only undeletes files from the recycle bin - is that correct?

  7. #7
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    if thats the case then ntfsundelete is the most useless utility I've ever seen

  8. #8
    Senior Member
    Join Date
    Jan 2011
    Posts
    242
    I'm confused. I thought this was the Knoppix forums and so not the place to ask trickly Windoze questions. Did someone on a Windoze forum say they couldn't help and suggest you try your luck on the Knoppix forums ?

    My simple understanding is that NTFS is a secure file system in the sense that the old VFAT is not. That means that when you delete a file under Windoze (instead of just sin binning it), it is supposed to stay deleted. The same security means the data in the file isn't deleted and it could be a long time before it is over written. So while you can't get to your data any more, those from whom you have nothing to hide can. To find out more, ask at micro$oft.com.

    There is a Linux package called ntfsprogs containing a tool called ntfsundelete that doesn't respect your privacy and can be used to recover (note recover, not restore) deleted files if you are lucky. Our friend dinosoep has very kindly given a reference to a dummies guide to the ntfsundelete command. Knoppix comes with the ntfsprogs package already installed. So what more do you want ? I'm not about to go out and buy Windoze in order to install on an otherwise perfectly happy PC so I can trash the installation just so I can see if the tool does what the documentation says it does. Try it for yourself.

    The command, despite it's name, does not undelete files. It will copy deleted files somewhere safe (i.e. your Knoppix home directory so if you're using a CD, don't reboot). It does not write to the NTFS partition, it only reads from it. Harry would approve.

    First recover your lost file and save it to a USB stick. Then worry about how to get it back onto your Windoze machine. If your Windoze won't boot, dinosoep might be able to help. If Windoze will boot, do the drag-and-drop thing Windoze users are so good at.

    As for you dinosoep, you should be ashamed of yourself.

    I cross the road everyday and I've been doing it for years and I've never been run down but I'm not about to encourage anyone not to take road safety seriously. Harry is a System Administrator. That's like being a doctor in the ER (ED or whatever it's called in your timezone). He gets to see the results of 'accidents', gets to clean up the mess of other people's foolishness and sometimes the joy of saying "We did all we could but your file system was too badly damaged" and seeing the look of horror on their faces.

    Harry's views may sound extreme but I take him seriously. Consider how and why you use NTFS file systems from Linux and look to reduce / eliminate that use. Need extra storage ? Use your NAS. Want to share files ? Repartition your disk so you've a C: and a D:. Windoze is on C: and so is your Windoze home directory. Don't write to C: from Linux, only to D: then you can't destroy your C: drive by accident.

    Yes, ntfs-3g is as safe as they can make it. No, it doesn't do dangerous things like mess with ACLs. But no file system is totally bullet proof. Even Linux file systems can be corrupted when the power outs. ntfg-3g is a fuse file system. By definition, it is more vulnerable. So you don't mind taking risks. By definition, ntfs-3g is also slower and needs more memory and CPU resources than kernel file systems. There is no good reason to use ntfs-3g long term other than sloth.
    Last edited by Forester; 03-09-2011 at 12:11 AM.

  9. #9
    Senior Member
    Join Date
    Jan 2011
    Posts
    123
    oops, never looked at it that way.
    and I didn't knew ntfs was slower.
    maybe I should consider creating a new partition, it's no big deal because I already have the ext3 drivers on my 'windoze' installed.
    It's just that I've seen windows itself ruin the ntfs part more then linux mint that frequently writes to ntfs and has helped restoring it again and again...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


A-Tech 8GB DDR3 1600 PC3-12800 Laptop SODIMM 204-Pin Memory RAM PC3L DDR3L 1x 8G picture

A-Tech 8GB DDR3 1600 PC3-12800 Laptop SODIMM 204-Pin Memory RAM PC3L DDR3L 1x 8G

$13.99



HyperX FURY RAM DDR4 16GB 8GB 32GB 4GB 3200 2666 2400 2133 Desktop Memory DIMM picture

HyperX FURY RAM DDR4 16GB 8GB 32GB 4GB 3200 2666 2400 2133 Desktop Memory DIMM

$9.64



A-Tech 16GB 2 x 8GB PC3-12800 Laptop SODIMM DDR3 1600 Memory RAM PC3L 16G DDR3L picture

A-Tech 16GB 2 x 8GB PC3-12800 Laptop SODIMM DDR3 1600 Memory RAM PC3L 16G DDR3L

$27.98



A-Tech 8GB PC3-12800 Desktop DDR3 1600 MHz Non ECC 240-Pin DIMM Memory RAM 1x 8G picture

A-Tech 8GB PC3-12800 Desktop DDR3 1600 MHz Non ECC 240-Pin DIMM Memory RAM 1x 8G

$13.99



CRUCIAL DDR3L 8GB 16GB 32GB 1600 MHz PC3-12800 Laptop Memory RAM SODIMM 204-Pin picture

CRUCIAL DDR3L 8GB 16GB 32GB 1600 MHz PC3-12800 Laptop Memory RAM SODIMM 204-Pin

$14.35



HMT84GL7AMR4C-RD 32GB DDR3 Server Memory RAM 14900L ECC REG 4Rx4 SK Hynix Cisco picture

HMT84GL7AMR4C-RD 32GB DDR3 Server Memory RAM 14900L ECC REG 4Rx4 SK Hynix Cisco

$13.99



A-Tech 16GB 2x 8GB PC3-12800 Desktop DDR3 1600 MHz 240pin DIMM Memory RAM 16G 8G picture

A-Tech 16GB 2x 8GB PC3-12800 Desktop DDR3 1600 MHz 240pin DIMM Memory RAM 16G 8G

$27.98



Crucial  DDR3 16GB 1600 2x 8GB PC3-12800 Laptop SODIMM Memory RAM PC3L 16G DDR3L picture

Crucial DDR3 16GB 1600 2x 8GB PC3-12800 Laptop SODIMM Memory RAM PC3L 16G DDR3L

$21.95



Hynix 64GB 4Rx4 PC4-2133P-L LRDIMM DDR4-17000 ECC Load Reduced Server Memory RAM picture

Hynix 64GB 4Rx4 PC4-2133P-L LRDIMM DDR4-17000 ECC Load Reduced Server Memory RAM

$64.99



A-Tech 64GB 4x 16GB 2Rx4 PC4-19200R DDR4 2400MHz ECC REG RDIMM Server Memory RAM picture

A-Tech 64GB 4x 16GB 2Rx4 PC4-19200R DDR4 2400MHz ECC REG RDIMM Server Memory RAM

$87.96