Undelete a file on NTFS

[rbrayer]

I would like to know how to undelete a file in C:\Windows\System32 (NTFS) using Knoppix. Thanks. Ron

[Harry Kuhman]

It doesn't do that. In fact you should never write to NTFS at all with Knoppix.

[fergus]

It doesn't do that. In fact you should never write to NTFS at all with Knoppix.

Are you serious? I thought current mounting procedures, for current NTFS architecture, were completely robust.
I've been reading / writing / editing / deleting for literally years. No problems encountered so far (and certainly not with Knoppix >= 5.1).
Fergus

[dinosoep]

@fergus
http://www.knoppix.net/forum/threads...king-with-ntfs
never had a problem myself and never really listened to the warnings
I don't think it's that unsafe anymore...

[dinosoep]

and look at this:http://www.howtogeek.com/howto/13706...buntu-live-cd/
it's ubuntu but I think it's also in the debian repos?

[rbrayer]

I deleted the file while booted into safe-mode with command prompt so i don't think it went into the recycle bin. Does anybody here know what I'm talking about? Thanks! I think ntfsundelete only undeletes files from the recycle bin - is that correct?

[dinosoep]

if thats the case then ntfsundelete is the most useless utility I've ever seen

[Forester]

I'm confused. I thought this was the Knoppix forums and so not the place to ask trickly Windoze questions. Did someone on a Windoze forum say they couldn't help and suggest you try your luck on the Knoppix forums ?

My simple understanding is that NTFS is a secure file system in the sense that the old VFAT is not. That means that when you delete a file under Windoze (instead of just sin binning it), it is supposed to stay deleted. The same security means the data in the file isn't deleted and it could be a long time before it is over written. So while you can't get to your data any more, those from whom you have nothing to hide can. To find out more, ask at micro$oft.com.

There is a Linux package called ntfsprogs containing a tool called ntfsundelete that doesn't respect your privacy and can be used to recover (note recover, not restore) deleted files if you are lucky. Our friend dinosoep has very kindly given a reference to a dummies guide to the ntfsundelete command. Knoppix comes with the ntfsprogs package already installed. So what more do you want ? I'm not about to go out and buy Windoze in order to install on an otherwise perfectly happy PC so I can trash the installation just so I can see if the tool does what the documentation says it does. Try it for yourself.

The command, despite it's name, does not undelete files. It will copy deleted files somewhere safe (i.e. your Knoppix home directory so if you're using a CD, don't reboot). It does not write to the NTFS partition, it only reads from it. Harry would approve.

First recover your lost file and save it to a USB stick. Then worry about how to get it back onto your Windoze machine. If your Windoze won't boot, dinosoep might be able to help. If Windoze will boot, do the drag-and-drop thing Windoze users are so good at.

As for you dinosoep, you should be ashamed of yourself.

I cross the road everyday and I've been doing it for years and I've never been run down but I'm not about to encourage anyone not to take road safety seriously. Harry is a System Administrator. That's like being a doctor in the ER (ED or whatever it's called in your timezone). He gets to see the results of 'accidents', gets to clean up the mess of other people's foolishness and sometimes the joy of saying "We did all we could but your file system was too badly damaged" and seeing the look of horror on their faces.

Harry's views may sound extreme but I take him seriously. Consider how and why you use NTFS file systems from Linux and look to reduce / eliminate that use. Need extra storage ? Use your NAS. Want to share files ? Repartition your disk so you've a C: and a D:. Windoze is on C: and so is your Windoze home directory. Don't write to C: from Linux, only to D: then you can't destroy your C: drive by accident.

Yes, ntfs-3g is as safe as they can make it. No, it doesn't do dangerous things like mess with ACLs. But no file system is totally bullet proof. Even Linux file systems can be corrupted when the power outs. ntfg-3g is a fuse file system. By definition, it is more vulnerable. So you don't mind taking risks. By definition, ntfs-3g is also slower and needs more memory and CPU resources than kernel file systems. There is no good reason to use ntfs-3g long term other than sloth.

[dinosoep]

oops, never looked at it that way.
and I didn't knew ntfs was slower.
maybe I should consider creating a new partition, it's no big deal because I already have the ext3 drivers on my 'windoze' installed.
It's just that I've seen windows itself ruin the ntfs part more then linux mint that frequently writes to ntfs and has helped restoring it again and again...