1

User accidentally deleted directory with firm data on laptop with Windows 8. I booted Ubuntu liveCD but using :

$sudo fdisk -l

WARNING: GPT (GUID Partition Table) detected on '/dev/sda'! The util fdisk doesn't support GPT. Use GNU Parted.


Disk /dev/sda: 750.2 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders, total 1465149168 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 4096 bytes
I/O size (minimum/optimal): 4096 bytes / 4096 bytes
Disk identifier: 0x4ad209d2
Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1  1465149167   732574583+  ee  GPT
Partition 1 does not start on physical sector boundary.

and 

$ sudo ntfsundelete /dev/sda1

returned all files with flag F..! and impossible to undelete.

How to get back these files? (history for specified directory and bin on Win8 of course are empty).

Michal_Szulc
  • 113
  • 6

1 Answers1

0

User accidentally deleted directory with firm data on laptop with Windows 8

Since the user deleted a directory but the file system itself is working, you can use Testdisk:

testdisk /dev/sda

Follow the on-screen instructions. Basically you will need to:

  • Select the drive
  • Wait for the scan to finish
  • Highlight the affected partition
  • Press P to open the browser
  • Browser the directory tree until you highlight the deleted folder
  • Press C to copy it on some other drive

If this fails or the file system is severely damaged, check out this answer of mine on AskUbuntu.

Community
  • 1
Andrea Lazzarotto
  • 131
  • 1
  • 1
  • 7