Recover deleted files from NTFS filesystem from Ubuntu Linux - Ntfsundelete

If you have accidentally deleted files from your hard drive, don't panic! You can easily recover deleted files whether you are using a Windows PC (NTFS) or Linux OS. You can undelete files with almost guaranteed success. The most important thing is to act as soon as you realize that the files are lost.

When a file is deleted from your computer it is not really deleted. It is simply removed from the directory of files in the folder. Even though you can no longer see the file in the folder, its contents still exist 100% intact at this point.

If you're using Windows and you deleted the file using Windows Explorer, the file will have been moved to the Recycle Bin, as long as a file remains there it can easily be restored in its entirety, with no problem at all. So the first thing to do when you want to recover a deleted file is look in the Recycle Bin. If it's there, use the Restore option which will move it back to its original location.

If you emptied the bin, used Shift Delete to get rid of the file, deleted it from within an application or used some other method of removing it that bypassed the bin, then it is still almost certainly recoverable. When you empty the Recycle Bin or delete a file using another method, the file is still not really deleted. The file no longer exists as far as the operating system is concerned and the space it occupied becomes available for re-use by other files. But the disk space does not get re-used straight away so the data that the deleted file contained will stay on your hard drive for some time to come.

At this point of time you can use Linux OS to recover the deleted file from the windows OS running under NTFS partition using tool call - Ntfsundelete

Installation:
Open up the terminal and type following command: sudo apt-get install ntfsprogs

The ntfsprogs package contains userspace tools: mkntfs, ntfscat, ntfsclone, ntfscluster, ntfscp, ntfsfix, ntfsinfo, ntfslabel, ntfsls, ntfsresize, ntfsundelete, etc and a shared NTFS library.

Using Ntfsundelete:
Figure out which drive  (NTFS) you want to undelete the files from. Open a terminal window and enter the following command in it: sudo fdisk -l this will give you the list of partition present in your drive

Now that you know the name Ubuntu has assigned to your hard drive, we’ll scan it to see what files we can uncover, In the terminal window, type: sudo ntfsundelete /dev/sda1
(replace the /dev/sda1 to your actual drive)

The names of files that can recovered show up in the far right column. The percentage in the third column tells us how much of that file can be recovered.

To quickly recover the PNGs, we will use the * wildcard to recover all of the files that end with .png.
Open up the terminal window, enter: sudo ntfsundelete /dev/sda1 –u –m *.png